Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 2681–2700 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

HighPublished 11 Sep 2025, 23:52 WIB

CVE-2025-39761

wifi: ath12k: Decrement TID on RX peer frag setup error handling

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Decrement TID on RX peer frag setup error handling Currently, TID is not decremented before peer cleanup, during error handling path of ath12k_dp_rx_peer_frag_setup(). This could lead to out-of-bounds access in peer->rx_tid[]. Hence, a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-11T16:52:29.788Z. Updated 2026-08-05T12:05:01.054Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:05 WIB

Official record

UnscoredPublished 11 Sep 2025, 23:52 WIB

CVE-2025-39760

usb: core: config: Prevent OOB read in SS endpoint companion parsing

In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buffer size. Fix this up by checking the size first before lo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2681 to 2700 of 4319.First page Next page

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-11T16:52:29.045Z. Updated 2026-06-11T18:44:09.050Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Jun 2026, 01:44 WIB

Official record

UnscoredPublished 11 Sep 2025, 23:52 WIB

CVE-2025-39759

btrfs: qgroup: fix race between quota disable and quota rescan ioctl

In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix race between quota disable and quota rescan ioctl There's a race between a task disabling quotas and another running the rescan ioctl that can result in a use-after-free of qgroup records from the fs_info->qgroup_tree rbtree. This…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-11T16:52:28.314Z. Updated 2026-05-12T12:06:49.038Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:06 WIB

Official record

CritPublished 11 Sep 2025, 23:52 WIB

CVE-2025-39758

RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages Ever since commit c2ff29e99a76 ("siw: Inline do_tcp_sendpages()"), we have been doing this: static int siw_tcp_sendpages(struct socket *s, struct page **page, int offset, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-11T16:52:27.598Z. Updated 2026-08-23T12:45:23.784Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated23 Aug 2026, 19:45 WIB

Official record

UnscoredPublished 11 Sep 2025, 23:52 WIB

CVE-2025-39757

ALSA: usb-audio: Validate UAC3 cluster segment descriptors

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwise malicious firmware…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-11T16:52:26.900Z. Updated 2026-06-11T18:44:11.716Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Jun 2026, 01:44 WIB

Official record

UnscoredPublished 11 Sep 2025, 23:52 WIB

CVE-2025-39756

fs: Prevent file descriptor table allocations exceeding INT_MAX

In the Linux kernel, the following vulnerability has been resolved: fs: Prevent file descriptor table allocations exceeding INT_MAX When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file descriptors near the limit can trigger massive memory alloca…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-11T16:52:26.136Z. Updated 2026-10-15T01:08:10.812Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:08 WIB

Official record

UnscoredPublished 11 Sep 2025, 23:52 WIB

CVE-2025-39754

mm/smaps: fix race between smaps_hugetlb_range and migration

In the Linux kernel, the following vulnerability has been resolved: mm/smaps: fix race between smaps_hugetlb_range and migration smaps_hugetlb_range() handles the pte without holdling ptl, and may be concurrenct with migration, leaing to BUG_ON in pfn_swap_entry_to_page(). The race is as follows. smaps_hugetlb_rang…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-11T16:52:24.763Z. Updated 2026-10-21T12:37:19.186Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:37 WIB

Official record

UnscoredPublished 11 Sep 2025, 23:52 WIB

CVE-2025-39753

gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops

In the Linux kernel, the following vulnerability has been resolved: gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops Clears up the warning added in 7ee3647243e5 ("migrate: Remove call to ->writepage") that occurs in various xfstests, causing "something found in dmesg" failures. [ 341.136573] gfs2_meta_aops does no…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-11T16:52:24.082Z. Updated 2026-05-11T21:35:35.584Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:35 WIB

Official record

UnscoredPublished 11 Sep 2025, 23:52 WIB

CVE-2025-39752

ARM: rockchip: fix kernel hang during smp initialization

In the Linux kernel, the following vulnerability has been resolved: ARM: rockchip: fix kernel hang during smp initialization In order to bring up secondary CPUs main CPU write trampoline code to SRAM. The trampoline code is written while secondary CPUs are powered on (at least that true for RK3188 CPU). Sometimes tha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-11T16:52:23.372Z. Updated 2026-05-12T12:06:45.444Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:06 WIB

Official record

HighPublished 11 Sep 2025, 23:52 WIB

CVE-2025-39750

wifi: ath12k: Correct tid cleanup when tid setup fails

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Correct tid cleanup when tid setup fails Currently, if any error occurs during ath12k_dp_rx_peer_tid_setup(), the tid value is already incremented, even though the corresponding TID is not actually allocated. Proceed to ath12k_dp_rx_pee…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-11T16:52:21.917Z. Updated 2026-10-15T22:02:31.513Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

UnscoredPublished 11 Sep 2025, 23:52 WIB

CVE-2025-39749

rcu: Protect ->defer_qs_iw_pending from data race

In the Linux kernel, the following vulnerability has been resolved: rcu: Protect ->defer_qs_iw_pending from data race On kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is invoked within an interrupts-disabled region of code [1], it will invoke rcu_read_unlock_special(), which uses an irq-work handler to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-11T16:52:21.228Z. Updated 2026-05-12T12:06:44.240Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:06 WIB

Official record

UnscoredPublished 11 Sep 2025, 23:52 WIB

CVE-2025-39748

bpf: Forget ranges when refining tnum after JSET

In the Linux kernel, the following vulnerability has been resolved: bpf: Forget ranges when refining tnum after JSET Syzbot reported a kernel warning due to a range invariant violation on the following BPF program. 0: call bpf_get_netns_cookie 1: if r0 == 0 goto <exit> 2: if r0 & Oxffffffff goto <exit> The is…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-11T16:52:20.534Z. Updated 2026-10-15T01:08:08.823Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:08 WIB

Official record

UnscoredPublished 11 Sep 2025, 23:52 WIB

CVE-2025-39747

drm/msm: Add error handling for krealloc in metadata setup

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Add error handling for krealloc in metadata setup Function msm_ioctl_gem_info_set_metadata() now checks for krealloc failure and returns -ENOMEM, avoiding potential NULL pointer dereference. Explicitly avoids __GFP_NOFAIL due to deadlock ris…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-11T16:52:19.816Z. Updated 2026-05-11T21:35:29.849Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:35 WIB

Official record

UnscoredPublished 11 Sep 2025, 23:52 WIB

CVE-2025-39746

wifi: ath10k: shutdown driver when hardware is unreliable

In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: shutdown driver when hardware is unreliable In rare cases, ath10k may lose connection with the PCIe bus due to some unknown reasons, which could further lead to system crashes during resuming due to watchdog timeout: ath10k_pci 0000:01…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-11T16:52:19.112Z. Updated 2026-05-11T21:35:28.714Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:35 WIB

Official record

UnscoredPublished 11 Sep 2025, 23:52 WIB

CVE-2025-39745

rcutorture: Fix rcutorture_one_extend_check() splat in RT kernels

In the Linux kernel, the following vulnerability has been resolved: rcutorture: Fix rcutorture_one_extend_check() splat in RT kernels For built with CONFIG_PREEMPT_RT=y kernels, running rcutorture tests resulted in the following splat: [ 68.797425] rcutorture_one_extend_check during change: Current 0x1 To add 0x1…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-11T16:52:18.423Z. Updated 2026-05-11T21:35:27.553Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:35 WIB

Official record

UnscoredPublished 11 Sep 2025, 23:52 WIB

CVE-2025-39744

rcu: Fix rcu_read_unlock() deadloop due to IRQ work

In the Linux kernel, the following vulnerability has been resolved: rcu: Fix rcu_read_unlock() deadloop due to IRQ work During rcu_read_unlock_special(), if this happens during irq_exit(), we can lockup if an IPI is issued. This is because the IPI itself triggers the irq_exit() path causing a recursive lock up. This…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-11T16:52:17.725Z. Updated 2026-05-11T21:35:26.395Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:35 WIB

Official record

UnscoredPublished 11 Sep 2025, 23:52 WIB

CVE-2025-39743

jfs: truncate good inode pages when hard link is 0

In the Linux kernel, the following vulnerability has been resolved: jfs: truncate good inode pages when hard link is 0 The fileset value of the inode copy from the disk by the reproducer is AGGR_RESERVED_I. When executing evict, its hard link number is 0, so its inode pages are not truncated. This causes the bugon to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-11T16:52:17.043Z. Updated 2026-05-12T12:06:43.112Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:06 WIB

Official record

UnscoredPublished 11 Sep 2025, 23:52 WIB

CVE-2025-39742

RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()

In the Linux kernel, the following vulnerability has been resolved: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() The function divides number of online CPUs by num_core_siblings, and later checks the divider by zero. This implies a possibility to get and divide-by-zero runtime error. Fix it by movi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-11T16:52:16.339Z. Updated 2026-05-12T12:06:41.965Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:06 WIB

Official record

UnscoredPublished 11 Sep 2025, 23:52 WIB

CVE-2025-39741

drm/xe/migrate: don't overflow max copy size

In the Linux kernel, the following vulnerability has been resolved: drm/xe/migrate: don't overflow max copy size With non-page aligned copy, we need to use 4 byte aligned pitch, however the size itself might still be close to our maximum of ~8M, and so the dimensions of the copy can easily exceed the S16_MAX limit of…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-11T16:52:15.353Z. Updated 2026-05-11T21:35:22.681Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:35 WIB

Official record

HighPublished 11 Sep 2025, 23:52 WIB

CVE-2025-39740

drm/xe/migrate: prevent potential UAF

In the Linux kernel, the following vulnerability has been resolved: drm/xe/migrate: prevent potential UAF If we hit the error path, the previous fence (if there is one) has already been put() prior to this, so doing a fence_wait could lead to UAF. Tweak the flow to do to the put() until after we do the wait. (cherry…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-11T16:52:14.638Z. Updated 2026-08-05T12:04:57.846Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:04 WIB

Official record