Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 1361–1380 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

HighPublished 19 Sep 2025, 22:26 WIB

CVE-2025-39857

net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() BUG: kernel NULL pointer dereference, address: 00000000000002ec PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 28 UID: 0 PID: 343 Comm: kworker/28:1 Kdump: loaded Tainted: G …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T15:26:28.225Z. Updated 2026-10-15T22:02:32.358Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

UnscoredPublished 19 Sep 2025, 22:26 WIB

CVE-2025-39856

net: ethernet: ti: am65-cpsw-nuss: Fix null pointer dereference for ndev

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix null pointer dereference for ndev In the TX completion packet stage of TI SoCs with CPSW2G instance, which has single external ethernet port, ndev is accessed without being initialized if no TX packets have been…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1361 to 1380 of 4319.First page Next page

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T15:26:27.431Z. Updated 2026-05-11T21:37:45.987Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:37 WIB

Official record

UnscoredPublished 19 Sep 2025, 22:26 WIB

CVE-2025-39855

ice: fix NULL access of tx->in_use in ice_ptp_ts_irq

In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL access of tx->in_use in ice_ptp_ts_irq The E810 device has support for a "low latency" firmware interface to access and read the Tx timestamps. This interface does not use the standard Tx timestamp logic, due to the latency overhead of …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T15:26:26.717Z. Updated 2026-05-11T21:37:44.845Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:37 WIB

Official record

HighPublished 19 Sep 2025, 22:26 WIB

CVE-2025-39854

ice: fix NULL access of tx->in_use in ice_ll_ts_intr

In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL access of tx->in_use in ice_ll_ts_intr Recent versions of the E810 firmware have support for an extra interrupt to handle report of the "low latency" Tx timestamps coming from the specialized low latency firmware interface. Instead of p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T15:26:25.989Z. Updated 2026-08-05T12:05:39.158Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:05 WIB

Official record

UnscoredPublished 19 Sep 2025, 22:26 WIB

CVE-2025-39853

i40e: Fix potential invalid access when MAC list is empty

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix potential invalid access when MAC list is empty list_first_entry() never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading to potential invalid memory access when dereferenced. Fix this by using …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T15:26:25.101Z. Updated 2026-05-12T12:07:39.499Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:07 WIB

Official record

UnscoredPublished 19 Sep 2025, 22:26 WIB

CVE-2025-39852

net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6

In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 When tcp_ao_copy_all_matching() fails in tcp_v6_syn_recv_sock() it just exits the function. This ends up causing a memory-leak: unreferenced object 0xffff0000281a8200 (size 2496): …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T15:26:24.312Z. Updated 2026-05-11T21:37:41.374Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:37 WIB

Official record

HighPublished 19 Sep 2025, 22:26 WIB

CVE-2025-39851

vxlan: Fix NPD when refreshing an FDB entry with a nexthop object

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object VXLAN FDB entries can point to either a remote destination or an FDB nexthop group. The latter is usually used in EVPN deployments where learning is disabled. However, when learning i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T15:26:23.576Z. Updated 2026-10-21T12:37:28.487Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:37 WIB

Official record

UnscoredPublished 19 Sep 2025, 22:26 WIB

CVE-2025-39850

vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects When the "proxy" option is enabled on a VXLAN device, the device will suppress ARP requests and IPv6 Neighbor Solicitation messages if it is able to reply on behalf of the remote host.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T15:26:22.803Z. Updated 2026-10-21T12:37:27.412Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:37 WIB

Official record

HighPublished 19 Sep 2025, 22:26 WIB

CVE-2025-39849

wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would lead to memory corruption so add some bounds checking.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T15:26:22.073Z. Updated 2026-08-05T12:05:37.003Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:05 WIB

Official record

HighPublished 19 Sep 2025, 22:26 WIB

CVE-2025-39848

ax25: properly unshare skbs in ax25_kiss_rcv()

In the Linux kernel, the following vulnerability has been resolved: ax25: properly unshare skbs in ax25_kiss_rcv() Bernard Pidoux reported a regression apparently caused by commit c353e8983e0d ("net: introduce per netns packet chains"). skb->dev becomes NULL and we crash in __netif_receive_skb_core(). Before above …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T15:26:21.403Z. Updated 2026-08-05T12:05:35.803Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:05 WIB

Official record

UnscoredPublished 19 Sep 2025, 22:26 WIB

CVE-2025-39847

ppp: fix memory leak in pad_compress_skb

In the Linux kernel, the following vulnerability has been resolved: ppp: fix memory leak in pad_compress_skb If alloc_skb() fails in pad_compress_skb(), it returns NULL without releasing the old skb. The caller does: skb = pad_compress_skb(ppp, skb); if (!skb) goto drop; drop: kfree_skb(skb); W…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T15:26:20.648Z. Updated 2026-05-12T12:07:35.941Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:07 WIB

Official record

UnscoredPublished 19 Sep 2025, 22:26 WIB

CVE-2025-39846

pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()

In the Linux kernel, the following vulnerability has been resolved: pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() In __iodyn_find_io_region(), pcmcia_make_resource() is assigned to res and used in pci_bus_alloc_resource(). There is a dereference of res in pci_bus_alloc_resource(), which could lea…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T15:26:19.932Z. Updated 2026-05-12T12:07:34.761Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:07 WIB

Official record

UnscoredPublished 19 Sep 2025, 22:26 WIB

CVE-2025-39845

x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings()

In the Linux kernel, the following vulnerability has been resolved: x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() Define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() to ensure page tables are properly synchronized when calling p*d_populate_kernel(). For 5-level paging, sync…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T15:26:19.225Z. Updated 2026-10-15T01:08:29.237Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:08 WIB

Official record

UnscoredPublished 19 Sep 2025, 22:26 WIB

CVE-2025-39844

mm: move page table sync declarations to linux/pgtable.h

In the Linux kernel, the following vulnerability has been resolved: mm: move page table sync declarations to linux/pgtable.h During our internal testing, we started observing intermittent boot failures when the machine uses 4-level paging and has a large amount of persistent memory: BUG: unable to handle page faul…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T15:26:18.471Z. Updated 2026-05-12T12:07:32.370Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:07 WIB

Official record

UnscoredPublished 19 Sep 2025, 22:26 WIB

CVE-2025-39843

mm: slub: avoid wake up kswapd in set_track_prepare

In the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in set_track_prepare set_track_prepare() can incur lock recursion. The issue is that it is called from hrtimer_start_range_ns holding the per_cpu(hrtimer_bases)[n].lock, but when enabled CONFIG_DEBUG_OBJECTS_TIMERS, may…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T15:26:17.758Z. Updated 2026-05-12T12:07:31.214Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:07 WIB

Official record

UnscoredPublished 19 Sep 2025, 22:26 WIB

CVE-2025-39842

ocfs2: prevent release journal inode after journal shutdown

In the Linux kernel, the following vulnerability has been resolved: ocfs2: prevent release journal inode after journal shutdown Before calling ocfs2_delete_osb(), ocfs2_journal_shutdown() has already been executed in ocfs2_dismount_volume(), so osb->journal must be NULL. Therefore, the following calltrace will inevi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T15:26:17.075Z. Updated 2026-05-12T12:07:30.064Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:07 WIB

Official record

CritPublished 19 Sep 2025, 22:26 WIB

CVE-2025-39841

scsi: lpfc: Fix buffer free/clear order in deferred receive path

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T15:26:16.349Z. Updated 2026-08-05T12:05:34.724Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:05 WIB

Official record

HighPublished 19 Sep 2025, 22:26 WIB

CVE-2025-39840

audit: fix out-of-bounds read in audit_compare_dname_path()

In the Linux kernel, the following vulnerability has been resolved: audit: fix out-of-bounds read in audit_compare_dname_path() When a watch on dir=/ is combined with an fsnotify event for a single-character name directly under / (e.g., creating /a), an out-of-bounds read can occur in audit_compare_dname_path(). The…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T15:26:15.596Z. Updated 2026-08-05T12:05:33.644Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:05 WIB

Official record

HighPublished 19 Sep 2025, 22:26 WIB

CVE-2025-39839

batman-adv: fix OOB read/write in network-coding decode

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix OOB read/write in network-coding decode batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing payload headroom, and the source skb length is not v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T15:26:14.688Z. Updated 2026-08-05T12:05:32.570Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:05 WIB

Official record

UnscoredPublished 19 Sep 2025, 22:26 WIB

CVE-2025-39838

cifs: prevent NULL pointer dereference in UTF16 conversion

In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dereference in UTF16 conversion There can be a NULL pointer dereference bug here. NULL is passed to __cifs_sfu_make_node without checks, which passes it unchecked to cifs_strndup_to_utf16, which in turn passes it to cifs_lo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T15:26:13.506Z. Updated 2026-05-12T12:07:26.229Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:07 WIB

Official record