Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2821–2840 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

UnscoredPublished 23 Oct 2026, 19:22 WIB

CVE-2026-99048

gve: fix napi_disable deadlock when attempting to disable XSK pools

In the Linux kernel, the following vulnerability has been resolved: gve: fix napi_disable deadlock when attempting to disable XSK pools When disabling XSK pools, GVE calls the unlocked versions of napi_disable and napi_enable. However, the netdev lock has already been acquired before ndo_bpf is called because GVE sup…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:22:13.825Z. Updated 2026-10-23T12:22:13.825Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:22 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:22 WIB

CVE-2026-99047

gve: fix XSK buffer leak when rings are stopped

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak when rings are stopped GVE does not free XSK buffers when resetting ring state as a part of stopping queues. This causes all XSK buffers which are posted to the NIC to be leaked. Free XSK buffers attached to an allocated buf…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2821 to 2840 of 16156.First page Next page

Published 2026-10-23T12:22:12.104Z. Updated 2026-10-23T12:22:12.104Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:22 WIB

Official record

HighPublished 23 Oct 2026, 19:22 WIB

CVE-2026-99046

gve: fix XSK buffer leak on error descriptor

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the buf_state and its attached buffer should be freed. In the case of AF_XDP ZC, the XSK buffer was not freed, leading to a leak. This issue was …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:22:10.460Z. Updated 2026-10-24T14:10:10.249Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:10 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:22 WIB

CVE-2026-99045

ibmveth: h_free logical LAN on open-fail after register

In the Linux kernel, the following vulnerability has been resolved: ibmveth: h_free logical LAN on open-fail after register ibmveth_open() registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out_free_buffer_pools without h_free_logical_lan(), so PHYP still owns the buffer-list page …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:22:09.352Z. Updated 2026-10-23T12:22:09.352Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:22 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:22 WIB

CVE-2026-99044

ice: fix use-after-free in dynamic port cleanup

In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup ice_dealloc_dynamic_port() uses dyn_port->vsi->idx to erase the dynamic port from pf->dyn_ports. However, it frees the VSI before reading the index for the erase, resulting in a use-after-free. Follow …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:22:08.328Z. Updated 2026-10-23T12:22:08.328Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:22 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:22 WIB

CVE-2026-99043

ice: fix metadata_dst refcount handling on representor teardown

In the Linux kernel, the following vulnerability has been resolved: ice: fix metadata_dst refcount handling on representor teardown ice_eswitch_release_repr() uses metadata_dst_free() to release the representor's metadata_dst. metadata_dst_free() directly frees the underlying memory without checking the dst_entry re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:22:07.372Z. Updated 2026-10-23T12:22:07.372Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:22 WIB

Official record

HighPublished 23 Oct 2026, 19:22 WIB

CVE-2026-99042

io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6

In the Linux kernel, the following vulnerability has been resolved: io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 io_connect_bpf_populate() fills connect.port and connect.v6_addr for AF_INET6 only when addr_len >= sizeof(struct sockaddr_in6), i.e. 28 bytes. The IPv6 connect paths accept SIN6_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:22:01.804Z. Updated 2026-10-24T14:10:09.161Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:10 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:22 WIB

CVE-2026-99041

ip6_gre: remove obsolete ERSPAN PMTU update

In the Linux kernel, the following vulnerability has been resolved: ip6_gre: remove obsolete ERSPAN PMTU update A tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan device. The legacy PMTU update in ip6erspan_tunnel_xmit() treats that metadata dst as a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:22:00.403Z. Updated 2026-10-23T12:22:00.403Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:22 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:21 WIB

CVE-2026-99040

KEYS: Fix add_key() race with keyring restriction

In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix add_key() race with keyring restriction __key_create_or_update() snapshots keyring->restrict_link before taking the destination keyring's semaphore. keyring_restrict() installs a restriction while holding that semaphore. This allows a wri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:21:59.288Z. Updated 2026-10-23T12:21:59.288Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:21 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:21 WIB

CVE-2026-99039

memstick: core: wait for request completion before freeing card

In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstick_alloc_card() and memstick_set_rw_addr(), wait_for_completion_timeout() is used to wait for device identification and address configuration requests to complete. The memstick…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:21:57.421Z. Updated 2026-10-23T12:21:57.421Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:21 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:21 WIB

CVE-2026-99038

memstick: rtsx_usb_ms: complete requests after eject instead of dropping them

In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: complete requests after eject instead of dropping them memstick_check() can pass its host->removing check just before rtsx_usb_ms_drv_remove() sets eject/removing. Its next request is then silently dropped: rtsx_usb_ms_request(…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:21:56.333Z. Updated 2026-10-23T12:21:56.333Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:21 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:21 WIB

CVE-2026-99037

dm-crypt: reject the lmk IV mode with AEAD ciphers

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: reject the lmk IV mode with AEAD ciphers A "capi:" table line that pairs an AEAD cipher with the lmk IV mode, for example "capi:gcm(aes)-lmk" with the integrity:28:aead option, causes an oops when it is loaded. lmk sets tfms_count to 64, bu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:21:54.317Z. Updated 2026-10-23T12:21:54.317Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:21 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:21 WIB

CVE-2026-99036

dm: fix reading free memory in do_resume

In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in do_resume When do_resume calls dm_table_get_mode(new_map), the call is done without holding any locks (it only holds a reference to the md). It may be possible that another concurrent ioctl on the same device will swap …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:21:49.410Z. Updated 2026-10-26T06:56:56.323Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 13:56 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:21 WIB

CVE-2026-99035

mmc: mtk-sd: Cancel request timeout work on remove

In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does not wait for a timeout callback that has already started. The timeout callback cal…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:21:44.522Z. Updated 2026-10-23T12:21:44.522Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:21 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:21 WIB

CVE-2026-99034

mmc: sdhci-sprd: disable runtime PM on remove

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhci_sprd_probe() enables runtime PM, while sdhci_sprd_remove() does not perform the corresponding runtime PM cleanup. The probe failure path disables runtime PM before disabling the clocks, but the nor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:21:41.941Z. Updated 2026-10-23T12:21:41.941Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:21 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:21 WIB

CVE-2026-99033

net/packet: guard the ll header push in packet_rcv_spkt()

In the Linux kernel, the following vulnerability has been resolved: net/packet: guard the ll header push in packet_rcv_spkt() packet_rcv_spkt() restores the link layer header with skb_push(skb, skb->data - skb_mac_header(skb)); That subtraction is only meaningful when the device actually has a link layer header. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:21:37.662Z. Updated 2026-10-23T12:21:37.662Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:21 WIB

Official record

HighPublished 23 Oct 2026, 19:21 WIB

CVE-2026-99032

net/smc: protect clcsock lifetime in smc_getname

In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smc_getname smc_getname() dereferences smc->clcsock without holding clcsock_release_lock. Link-group termination can release the CLC socket through smc_close_active_abort() while the SMC socket is still open, for …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:21:36.202Z. Updated 2026-10-24T14:10:08.095Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:10 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:21 WIB

CVE-2026-99031

net: bridge: avoid recursive multicast port cleanup

In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup br_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL port groups by calling br_multicast_del_pg(). For S,G entries, that deletion calls back into br_multicast_sg_del_exclude_por…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:21:31.535Z. Updated 2026-10-23T12:21:31.535Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:21 WIB

Official record

HighPublished 23 Oct 2026, 19:21 WIB

CVE-2026-99030

net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() When skb_copy_and_csum_bits() reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy into a b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:21:23.271Z. Updated 2026-10-24T14:10:06.982Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:10 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:21 WIB

CVE-2026-99029

net: sparx5: free the matchall entry on destroy

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for every offloaded matchall filter and adds it to sparx5->mall_entries. sparx5_tc_matchall_destroy() removes the entry from the list, b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:21:21.898Z. Updated 2026-10-23T12:21:21.898Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:21 WIB

Official record