Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,033 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2115.2%
High1,29032%
Med1,73543%
Low1343.3%
None30.07%
Legacy00.00%
Unscored66016%

Matching records by UTC month

Apr 254,033

Signal coverage

KEV-listed: 16
With a forecast: 4,033
Unknown date: 0
Unscored severity: 660

Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.

Showing 1541–1560 of 4,033By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 1,290, Medium · 4.0–6.9 1,735, Low · 0.1–3.9 134, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 660

UnscoredPublished 16 Apr 2025, 21:12 WIB

CVE-2025-22046

uprobes/x86: Harden uretprobe syscall trampoline check

In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Harden uretprobe syscall trampoline check Jann reported a possible issue when trampoline_check_ip returns address near the bottom of the address space that is allowed to call into the syscall if uretprobes are not set up: https://lor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T14:12:06.454Z. Updated 2026-05-11T21:11:35.531Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:11 WIB

Official record

HighPublished 16 Apr 2025, 21:12 WIB

CVE-2025-22045

x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs On the following path, flush_tlb_range() can be used for zapping normal PMD entries (PMD entries that point to page tables) together with the PTE entries in the pointed-to page table: …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1541 to 1560 of 4033.First page Next page

Published 2025-04-16T14:12:05.849Z. Updated 2026-10-15T21:51:57.120Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:51 WIB

Official record

HighPublished 16 Apr 2025, 21:12 WIB

CVE-2025-22044

acpi: nfit: fix narrowing conversion in acpi_nfit_ctl

In the Linux kernel, the following vulnerability has been resolved: acpi: nfit: fix narrowing conversion in acpi_nfit_ctl Syzkaller has reported a warning in to_nfit_bus_uuid(): "only secondary bus families can be translated". This warning is emited if the argument is equal to NVDIMM_BUS_FAMILY_NFIT == 0. Function ac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T14:12:05.199Z. Updated 2026-10-15T21:51:56.979Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:51 WIB

Official record

HighPublished 16 Apr 2025, 21:12 WIB

CVE-2025-22043

ksmbd: add bounds check for durable handle context

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add bounds check for durable handle context Add missing bounds check for durable handle context.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T14:12:04.558Z. Updated 2026-08-05T11:56:16.436Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:56 WIB

Official record

HighPublished 16 Apr 2025, 21:12 WIB

CVE-2025-22042

ksmbd: add bounds check for create lease context

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add bounds check for create lease context Add missing bounds check for create lease context.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T14:12:03.896Z. Updated 2026-08-05T11:56:15.350Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:56 WIB

Official record

HighPublished 16 Apr 2025, 21:11 WIB

CVE-2025-22041

ksmbd: fix use-after-free in ksmbd_sessions_deregister()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_sessions_deregister() In multichannel mode, UAF issue can occur in session_deregister when the second channel sets up a session through the connection of the first channel. session that is freed through the global s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T14:11:58.250Z. Updated 2026-08-05T11:56:14.282Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:56 WIB

Official record

HighPublished 16 Apr 2025, 21:11 WIB

CVE-2025-22040

ksmbd: fix session use-after-free in multichannel connection

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix session use-after-free in multichannel connection There is a race condition between session setup and ksmbd_sessions_deregister. The session can be freed before the connection is added to channel list of session. This patch check reference…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T14:11:57.601Z. Updated 2026-08-05T11:56:13.212Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:56 WIB

Official record

HighPublished 16 Apr 2025, 21:11 WIB

CVE-2025-22039

ksmbd: fix overflow in dacloffset bounds check

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix overflow in dacloffset bounds check The dacloffset field was originally typed as int and used in an unchecked addition, which could overflow and bypass the existing bounds check in both smb_check_perm_dacl() and smb_inherit_dacl(). This c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T14:11:56.975Z. Updated 2026-09-14T11:57:53.618Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated14 Sep 2026, 18:57 WIB

Official record

HighPublished 16 Apr 2025, 21:11 WIB

CVE-2025-22038

ksmbd: validate zero num_subauth before sub_auth is accessed

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate zero num_subauth before sub_auth is accessed Access psid->sub_auth[psid->num_subauth - 1] without checking if num_subauth is non-zero leads to an out-of-bounds read. This patch adds a validation step to ensure num_subauth != 0 before …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T14:11:56.316Z. Updated 2026-08-05T11:56:11.103Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:56 WIB

Official record

HighPublished 16 Apr 2025, 21:11 WIB

CVE-2025-22037

ksmbd: fix null pointer dereference in alloc_preauth_hash()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in alloc_preauth_hash() The Client send malformed smb2 negotiate request. ksmbd return error response. Subsequently, the client can send smb2 session setup even thought conn->preauth_info is not allocated. This pat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T14:11:55.670Z. Updated 2026-08-05T11:56:10.045Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:56 WIB

Official record

HighPublished 16 Apr 2025, 21:11 WIB

CVE-2025-22036

exfat: fix random stack corruption after get_block

In the Linux kernel, the following vulnerability has been resolved: exfat: fix random stack corruption after get_block When get_block is called with a buffer_head allocated on the stack, such as do_mpage_readpage, stack corruption due to buffer_head UAF may occur in the following race condition situation. <CPU …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T14:11:54.916Z. Updated 2026-08-05T11:56:08.974Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:56 WIB

Official record

HighPublished 16 Apr 2025, 21:11 WIB

CVE-2025-22035

tracing: Fix use-after-free in print_graph_function_flags during tracer switching

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in print_graph_function_flags during tracer switching Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can be reproduced if puting a 'mdelay(10)' after 'mutex_unlock(…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T14:11:53.958Z. Updated 2026-08-05T11:56:07.902Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:56 WIB

Official record

HighPublished 16 Apr 2025, 21:11 WIB

CVE-2025-22034

mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs

In the Linux kernel, the following vulnerability has been resolved: mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs Patch series "mm: fixes for device-exclusive entries (hmm)", v2. Discussing the PageTail() call in make_device_exclusive_range() with Willy, I recently discovered [1] that device-exclusive handling doe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T14:11:53.301Z. Updated 2026-08-05T11:56:06.819Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:56 WIB

Official record

UnscoredPublished 16 Apr 2025, 21:11 WIB

CVE-2025-22033

arm64: Don't call NULL in do_compat_alignment_fixup()

In the Linux kernel, the following vulnerability has been resolved: arm64: Don't call NULL in do_compat_alignment_fixup() do_alignment_t32_to_handler() only fixes up alignment faults for specific instructions; it returns NULL otherwise (e.g. LDREX). When that's the case, signal to the caller that it needs to proceed …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T14:11:52.696Z. Updated 2026-05-11T21:11:20.457Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:11 WIB

Official record

UnscoredPublished 16 Apr 2025, 21:11 WIB

CVE-2025-22032

wifi: mt76: mt7921: fix kernel panic due to null pointer dereference

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix kernel panic due to null pointer dereference Address a kernel panic caused by a null pointer dereference in the `mt792x_rx_get_wcid` function. The issue arises because the `deflink` structure is not properly initialized with t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T14:11:52.044Z. Updated 2026-05-23T15:57:41.119Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:57 WIB

Official record

UnscoredPublished 16 Apr 2025, 21:11 WIB

CVE-2025-22031

PCI/bwctrl: Fix NULL pointer dereference on bus number exhaustion

In the Linux kernel, the following vulnerability has been resolved: PCI/bwctrl: Fix NULL pointer dereference on bus number exhaustion When BIOS neglects to assign bus numbers to PCI bridges, the kernel attempts to correct that during PCI device enumeration. If it runs out of bus numbers, no pci_bus is allocated and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T14:11:51.264Z. Updated 2026-05-11T21:11:18.142Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:11 WIB

Official record

UnscoredPublished 16 Apr 2025, 21:11 WIB

CVE-2025-22030

mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead()

In the Linux kernel, the following vulnerability has been resolved: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() Currently, zswap_cpu_comp_dead() calls crypto_free_acomp() while holding the per-CPU acomp_ctx mutex. crypto_free_acomp() then holds scomp_lock (through crypto_exit_scomp_ops_async…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T14:11:50.625Z. Updated 2026-05-23T15:57:40.079Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:57 WIB

Official record

UnscoredPublished 16 Apr 2025, 21:11 WIB

CVE-2025-22028

media: vimc: skip .s_stream() for stopped entities

In the Linux kernel, the following vulnerability has been resolved: media: vimc: skip .s_stream() for stopped entities Syzbot reported [1] a warning prompted by a check in call_s_stream() that checks whether .s_stream() operation is warranted for unstarted or stopped subdevs. Add a simple fix in vimc_streamer_pipeli…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T14:11:48.913Z. Updated 2026-05-23T15:57:39.064Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:57 WIB

Official record

UnscoredPublished 16 Apr 2025, 21:11 WIB

CVE-2025-22027

media: streamzap: fix race between device disconnection and urb callback

In the Linux kernel, the following vulnerability has been resolved: media: streamzap: fix race between device disconnection and urb callback Syzkaller has reported a general protection fault at function ir_raw_event_store_with_filter(). This crash is caused by a NULL pointer dereference of dev->raw pointer, even thou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T14:11:48.210Z. Updated 2026-05-11T21:11:14.531Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:11 WIB

Official record

UnscoredPublished 16 Apr 2025, 21:11 WIB

CVE-2025-22026

nfsd: don't ignore the return code of svc_proc_register()

In the Linux kernel, the following vulnerability has been resolved: nfsd: don't ignore the return code of svc_proc_register() Currently, nfsd_proc_stat_init() ignores the return value of svc_proc_register(). If the procfile creation fails, then the kernel will WARN when it tries to remove the entry later. Fix nfsd_p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T14:11:47.243Z. Updated 2026-06-19T11:57:15.085Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Jun 2026, 18:57 WIB

Official record