Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 1621–1640 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

UnscoredPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40154

ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcr_rt5640 driver only shows an error message but leaves as is. This may lead to unepxected results like OOB access. This patch …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:28.470Z. Updated 2026-06-16T19:52:33.850Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Jun 2026, 02:52 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40153

mm: hugetlb: avoid soft lockup when mprotect to large memory area

In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: avoid soft lockup when mprotect to large memory area When calling mprotect() to a large hugetlb memory area in our customer's workload (~300GB hugetlb memory), soft lockup was observed: watchdog: BUG: soft lockup - CPU#98 stuck for 23s!…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1621 to 1640 of 3020.First page Next page

Published 2025-11-12T10:23:28.201Z. Updated 2026-05-11T21:43:45.768Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:43 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40152

drm/msm: Fix bootup splat with separate_gpu_drm modparam

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix bootup splat with separate_gpu_drm modparam The drm_gem_for_each_gpuvm_bo() call from lookup_vma() accesses drm_gem_obj.gpuva.list, which is not initialized when the drm driver does not support DRIVER_GEM_GPUVA feature. Enable it for msm…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:27.925Z. Updated 2026-05-11T21:43:44.630Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:43 WIB

Official record

HighPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40151

LoongArch: BPF: No support of struct argument in trampoline programs

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: No support of struct argument in trampoline programs The current implementation does not support struct argument. This causes a oops when running bpf selftest: $ ./test_progs -a tracing_struct Oops[#1]: CPU -1 Unable to handle …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:27.662Z. Updated 2026-08-05T12:08:05.901Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:08 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40150

f2fs: fix to avoid migrating empty section

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid migrating empty section It reports a bug from device w/ zufs: F2FS-fs (dm-64): Inconsistent segment (173822) type [1, 0] in SSA and SIT F2FS-fs (dm-64): Stopped filesystem due to reason: 4 Thread A Thread B - f2fs_expand_inode…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:27.399Z. Updated 2026-05-23T16:01:31.919Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 23:01 WIB

Official record

HighPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40149

tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().

In the Linux kernel, the following vulnerability has been resolved: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). get_netdev_for_sock() is called during setsockopt(), so not under RCU. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu(). Note that the only …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:27.122Z. Updated 2026-10-15T22:02:38.910Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40148

drm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functions

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functions The function dc_stream_set_cursor_attributes() currently dereferences the `stream` pointer and nested members `stream->ctx->dc->current_state` without checking for NULL.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:26.841Z. Updated 2026-05-11T21:43:39.984Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:43 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40147

blk-throttle: fix access race during throttle policy activation

In the Linux kernel, the following vulnerability has been resolved: blk-throttle: fix access race during throttle policy activation On repeated cold boots we occasionally hit a NULL pointer crash in blk_should_throtl() when throttling is consulted before the throttle policy is fully enabled for the queue. Checking on…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:26.556Z. Updated 2026-05-11T21:43:38.854Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:43 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40146

blk-mq: fix potential deadlock while nr_requests grown

In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix potential deadlock while nr_requests grown Allocate and free sched_tags while queue is freezed can deadlock[1], this is a long term problem, hence allocate memory before freezing queue and free memory after queue is unfreezed. [1] https:…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:26.287Z. Updated 2026-05-11T21:43:37.672Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:43 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40145

PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure

In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure When devm_add_action_or_reset() fails, it calls the passed cleanup function. Hence the caller must not repeat that cleanup. Replace the "goto err_regulator_free" by the actual fr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:26.013Z. Updated 2026-05-11T21:43:36.510Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:43 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40143

bpf: dont report verifier bug for missing bpf_scc_visit on speculative path

In the Linux kernel, the following vulnerability has been resolved: bpf: dont report verifier bug for missing bpf_scc_visit on speculative path Syzbot generated a program that triggers a verifier_bug() call in maybe_exit_scc(). maybe_exit_scc() assumes that, when called for a state with insn_idx in some SCC, there sh…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:25.489Z. Updated 2026-05-11T21:43:35.365Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:43 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40142

ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT snd_pcm_group_lock_irq() acquires a spinlock_t and disables interrupts via spin_lock_irq(). This also implicitly disables the handling of softirqs such as TIMER_SOFTIRQ. On P…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:25.191Z. Updated 2026-05-11T21:43:34.212Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:43 WIB

Official record

HighPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40141

Bluetooth: ISO: Fix possible UAF on iso_conn_free

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix possible UAF on iso_conn_free This attempt to fix similar issue to sco_conn_free where if the conn->sk is not set to NULL may lead to UAF on iso_conn_free.

Excerpt language: en.

Severity high: primary CNA CVSS 8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:24.856Z. Updated 2026-10-15T22:02:38.774Z.

CVSS8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

HighPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40140

net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast

In the Linux kernel, the following vulnerability has been resolved: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. This is the sequence of events that leads to the warning: rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:24.586Z. Updated 2026-08-05T12:08:02.642Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:08 WIB

Official record

HighPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40139

smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().

In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). smc_clc_prfx_set() is called during connect() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dev_dst_rcu() under rcu_read_loc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:24.216Z. Updated 2026-10-15T22:02:38.627Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40138

f2fs: fix to avoid NULL pointer dereference in f2fs_check_quota_consistency()

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid NULL pointer dereference in f2fs_check_quota_consistency() syzbot reported a f2fs bug as below: Oops: gen[ 107.736417][ T5848] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP K…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:23.912Z. Updated 2026-05-11T21:43:29.612Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:43 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40137

f2fs: fix to truncate first page in error path of f2fs_truncate()

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to truncate first page in error path of f2fs_truncate() syzbot reports a bug as below: loop0: detected capacity change from 0 to 40427 F2FS-fs (loop0): Wrong SSA boundary, start(3584) end(4096) blocks(3072) F2FS-fs (loop0): Can't find vali…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:23.624Z. Updated 2026-05-11T21:43:28.448Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:43 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40136

crypto: hisilicon/qm - request reserved interrupt for virtual function

In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - request reserved interrupt for virtual function The device interrupt vector 3 is an error interrupt for physical function and a reserved interrupt for virtual function. However, the driver has not registered the reserved interr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:23.330Z. Updated 2026-10-21T12:37:49.467Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:37 WIB

Official record

HighPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40135

ipv6: use RCU in ip6_xmit()

In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_xmit() Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:23.051Z. Updated 2026-10-15T01:08:59.375Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:08 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:23 WIB

CVE-2025-40134

dm: fix NULL pointer dereference in __dm_suspend()

In the Linux kernel, the following vulnerability has been resolved: dm: fix NULL pointer dereference in __dm_suspend() There is a race condition between dm device suspend and table load that can lead to null pointer dereference. The issue occurs when suspend is invoked before table load completes: BUG: kernel NULL p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:23:22.771Z. Updated 2026-05-11T21:43:24.586Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:43 WIB

Official record