Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 1601–1620 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

HighPublished 12 Nov 2025, 17:53 WIB

CVE-2025-40174

x86/mm: Fix SMP ordering in switch_mm_irqs_off()

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix SMP ordering in switch_mm_irqs_off() Stephen noted that it is possible to not have an smp_mb() between the loaded_mm store and the tlb_gen load in switch_mm(), meaning the ordering against flush_tlb_mm_range() goes out the window, and it …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:53:49.859Z. Updated 2026-08-05T12:08:19.978Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:08 WIB

Official record

HighPublished 12 Nov 2025, 17:53 WIB

CVE-2025-40173

net/ip6_tunnel: Prevent perpetual tunnel growth

In the Linux kernel, the following vulnerability has been resolved: net/ip6_tunnel: Prevent perpetual tunnel growth Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. While ipv4 tunnel headroom adjustment growth was limited in commit 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom gro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1601 to 1620 of 3020.First page Next page

Published 2025-11-12T10:53:49.571Z. Updated 2026-10-15T22:02:39.584Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

HighPublished 12 Nov 2025, 17:53 WIB

CVE-2025-40172

accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() Currently, if find_and_map_user_pages() takes a DMA xfer request from the user with a length field set to 0, or in a rare case, the host receives QAIC_TRANS_DMA_XFER_CONT from the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:53:49.245Z. Updated 2026-08-05T12:08:17.861Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:08 WIB

Official record

HighPublished 12 Nov 2025, 17:46 WIB

CVE-2025-40171

nvmet-fc: move lsop put work to nvmet_fc_ls_req_op

In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: move lsop put work to nvmet_fc_ls_req_op It’s possible for more than one async command to be in flight from __nvmet_fc_send_ls_req. For each command, a tgtport reference is taken. In the current code, only one put work item is queued at a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:46:52.289Z. Updated 2026-10-15T22:02:39.456Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

HighPublished 12 Nov 2025, 17:46 WIB

CVE-2025-40170

net: use dst_dev_rcu() in sk_setup_caps()

In the Linux kernel, the following vulnerability has been resolved: net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size(). Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip_dst_mtu_maybe_forward(). ip4_dst_hoplimit() can use dst_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:46:52.014Z. Updated 2026-10-21T12:37:51.619Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:37 WIB

Official record

HighPublished 12 Nov 2025, 17:46 WIB

CVE-2025-40169

bpf: Reject negative offsets for ALU ops

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative offsets for ALU ops When verifying BPF programs, the check_alu_op() function validates instructions with ALU operations. The 'offset' field in these instructions is a signed 16-bit integer. The existing check 'insn->off > 1' was…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:46:51.736Z. Updated 2026-10-15T22:02:39.320Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

HighPublished 12 Nov 2025, 17:46 WIB

CVE-2025-40168

smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().

In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). smc_clc_prfx_match() is called from smc_listen_work() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu(). Note that…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:46:51.422Z. Updated 2026-09-02T12:49:28.040Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated02 Sep 2026, 19:49 WIB

Official record

HighPublished 12 Nov 2025, 17:26 WIB

CVE-2025-40167

ext4: detect invalid INLINE_DATA + EXTENTS flag combination

In the Linux kernel, the following vulnerability has been resolved: ext4: detect invalid INLINE_DATA + EXTENTS flag combination syzbot reported a BUG_ON in ext4_es_cache_extent() when opening a verity file on a corrupted ext4 filesystem mounted without a journal. The issue is that the filesystem has an inode with bo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:26:24.498Z. Updated 2026-10-15T22:02:39.184Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

HighPublished 12 Nov 2025, 17:26 WIB

CVE-2025-40166

drm/xe/guc: Check GuC running state before deregistering exec queue

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Check GuC running state before deregistering exec queue In normal operation, a registered exec queue is disabled and deregistered through the GuC, and freed only after the GuC confirms completion. However, if the driver is forced to unbin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:26:24.143Z. Updated 2026-08-05T12:08:11.302Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:08 WIB

Official record

HighPublished 12 Nov 2025, 17:26 WIB

CVE-2025-40165

media: nxp: imx8-isi: m2m: Fix streaming cleanup on release

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: m2m: Fix streaming cleanup on release If streamon/streamoff calls are imbalanced, such as when exiting an application with Ctrl+C when streaming, the m2m usage_count will never reach zero and the ISI channel won't be freed. Besi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:26:23.806Z. Updated 2026-08-05T12:08:10.217Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:08 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:26 WIB

CVE-2025-40164

usbnet: Fix using smp_processor_id() in preemptible code warnings

In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix using smp_processor_id() in preemptible code warnings Syzbot reported the following warning: BUG: using smp_processor_id() in preemptible [00000000] code: dhcpcd/2879 caller is usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331 CP…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:26:23.482Z. Updated 2026-06-19T11:57:22.439Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Jun 2026, 18:57 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:26 WIB

CVE-2025-40163

sched/deadline: Stop dl_server before CPU goes offline

In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Stop dl_server before CPU goes offline IBM CI tool reported kernel warning[1] when running a CPU removal operation through drmgr[2]. i.e "drmgr -c cpu -r -q 1" WARNING: CPU: 0 PID: 0 at kernel/sched/cpudeadline.c:219 cpudl_set+0x58/0…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:26:23.199Z. Updated 2026-06-01T16:05:34.972Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Jun 2026, 23:05 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:26 WIB

CVE-2025-40162

ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails devm_kasprintf() may return NULL on memory allocation failure, but the debug message prints cpus->dai_name before checking it. Move the dev_dbg() call after the NULL check to prevent p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:26:22.883Z. Updated 2026-05-11T21:43:56.425Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:43 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:24 WIB

CVE-2025-40161

mailbox: zynqmp-ipi: Fix SGI cleanup on unbind

In the Linux kernel, the following vulnerability has been resolved: mailbox: zynqmp-ipi: Fix SGI cleanup on unbind The driver incorrectly determines SGI vs SPI interrupts by checking IRQ number < 16, which fails with dynamic IRQ allocation. During unbind, this causes improper SGI cleanup leading to kernel crash. Add…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:24:36.696Z. Updated 2026-05-11T21:43:55.108Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:43 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:24 WIB

CVE-2025-40160

xen/events: Return -EEXIST for bound VIRQs

In the Linux kernel, the following vulnerability has been resolved: xen/events: Return -EEXIST for bound VIRQs Change find_virq() to return -EEXIST when a VIRQ is bound to a different CPU than the one passed in. With that, remove the BUG_ON() from bind_virq_to_irq() to propogate the error upwards. Some VIRQs are pe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:24:36.429Z. Updated 2026-05-11T21:43:53.978Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:43 WIB

Official record

HighPublished 12 Nov 2025, 17:24 WIB

CVE-2025-40159

xsk: Harden userspace-supplied xdp_desc validation

In the Linux kernel, the following vulnerability has been resolved: xsk: Harden userspace-supplied xdp_desc validation Turned out certain clearly invalid values passed in xdp_desc from userspace can pass xp_{,un}aligned_validate_desc() and then lead to UBs or just invalid frames to be queued for xmit. desc->len clos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:24:36.104Z. Updated 2026-10-15T22:02:39.041Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

HighPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40158

ipv6: use RCU in ip6_output()

In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_output() Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent possible UAF. We can remove rcu_read_lock()/rcu_read_unlock() pairs from ip6_finish_output2().

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:29.516Z. Updated 2026-10-21T12:37:50.501Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:37 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40157

EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller

In the Linux kernel, the following vulnerability has been resolved: EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller When loading the i10nm_edac driver on some Intel Granite Rapids servers, a call trace may appear as follows: UBSAN: shift-out-of-bounds in drivers/edac/skx_common.c:453:16 shift e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:29.258Z. Updated 2026-05-11T21:43:50.466Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:43 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40156

PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe()

In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() The drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) which would lead to a error pointer dereference. Use IS_ERR_OR_NULL() to check that the pointer is valid.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:28.994Z. Updated 2026-05-11T21:43:49.328Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:43 WIB

Official record

HighPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40155

iommu/vt-d: debugfs: Fix legacy mode page table dump logic

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: debugfs: Fix legacy mode page table dump logic In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR maybe uninitialized or zero in that case and may cause oops like: Oops: general protection fault, probably for non-canoni…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:28.718Z. Updated 2026-08-05T12:08:07.016Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:08 WIB

Official record