Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,033 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2115.2%
High1,29032%
Med1,73543%
Low1343.3%
None30.07%
Legacy00.00%
Unscored66016%

Matching records by UTC month

Apr 254,033

Signal coverage

KEV-listed: 16
With a forecast: 4,033
Unknown date: 0
Unscored severity: 660

Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.

Showing 3701–3720 of 4,033By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 1,290, Medium · 4.0–6.9 1,735, Low · 0.1–3.9 134, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 660

UnscoredPublished 01 Apr 2025, 22:41 WIB

CVE-2025-21950

drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl

In the Linux kernel, the following vulnerability has been resolved: drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl In the "pmcmd_ioctl" function, three memory objects allocated by kmalloc are initialized by "hcall_get_cpu_state", which are then copied to user space. The initializer is indeed …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T15:41:10.949Z. Updated 2026-05-11T21:09:40.823Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:09 WIB

Official record

HighPublished 01 Apr 2025, 22:41 WIB

CVE-2025-21949

LoongArch: Set hugetlb mmap base address aligned with pmd size

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Set hugetlb mmap base address aligned with pmd size With ltp test case "testcases/bin/hugefork02", there is a dmesg error report message such as: kernel BUG at mm/hugetlb.c:5550! Oops - BUG[#1]: CPU: 0 UID: 0 PID: 1517 Comm: hugefork02…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3701 to 3720 of 4033.First page Next page

Published 2025-04-01T15:41:10.451Z. Updated 2026-08-05T11:55:33.607Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:55 WIB

Official record

UnscoredPublished 01 Apr 2025, 22:41 WIB

CVE-2025-21948

HID: appleir: Fix potential NULL dereference at raw event handle

In the Linux kernel, the following vulnerability has been resolved: HID: appleir: Fix potential NULL dereference at raw event handle Syzkaller reports a NULL pointer dereference issue in input_event(). BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: null-ptr-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T15:41:09.949Z. Updated 2026-05-11T21:09:38.330Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:09 WIB

Official record

HighPublished 01 Apr 2025, 22:41 WIB

CVE-2025-21947

ksmbd: fix type confusion via race condition when using ipc_msg_send_request

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix type confusion via race condition when using ipc_msg_send_request req->handle is allocated using ksmbd_acquire_id(&ipc_ida), based on ida_alloc. req->handle from ksmbd_ipc_login_request and FSCTL_PIPE_TRANSCEIVE ioctl can be same and it co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T15:41:09.457Z. Updated 2026-08-05T11:55:32.548Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:55 WIB

Official record

HighPublished 01 Apr 2025, 22:41 WIB

CVE-2025-21946

ksmbd: fix out-of-bounds in parse_sec_desc()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds in parse_sec_desc() If osidoffset, gsidoffset and dacloffset could be greater than smb_ntsd struct size. If it is smaller, It could cause slab-out-of-bounds. And when validating sid, It need to check it included subauth array…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T15:41:08.955Z. Updated 2026-08-05T11:55:31.476Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:55 WIB

Official record

HighPublished 01 Apr 2025, 22:41 WIB

CVE-2025-21945

ksmbd: fix use-after-free in smb2_lock

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb2_lock If smb_lock->zero_len has value, ->llist of smb_lock is not delete and flock is old one. It will cause use-after-free on error handling routine.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T15:41:08.471Z. Updated 2026-08-05T11:55:30.419Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:55 WIB

Official record

UnscoredPublished 01 Apr 2025, 22:41 WIB

CVE-2025-21944

ksmbd: fix bug on trap in smb2_lock

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix bug on trap in smb2_lock If lock count is greater than 1, flags could be old value. It should be checked with flags of smb_lock, not flags. It will cause bug-on trap from locks_free_lock in error handling routine.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T15:41:07.977Z. Updated 2026-05-11T21:09:33.682Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:09 WIB

Official record

UnscoredPublished 01 Apr 2025, 22:41 WIB

CVE-2025-21943

gpio: aggregator: protect driver attr handlers against module unload

In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: protect driver attr handlers against module unload Both new_device_store and delete_device_store touch module global resources (e.g. gpio_aggregator_lock). To prevent race conditions with module unload, a reference needs to be held.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T15:41:07.463Z. Updated 2026-05-11T21:09:32.538Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:09 WIB

Official record

UnscoredPublished 01 Apr 2025, 22:41 WIB

CVE-2025-21942

btrfs: zoned: fix extent range end unlock in cow_file_range()

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix extent range end unlock in cow_file_range() Running generic/751 on the for-next branch often results in a hang like below. They are both stack by locking an extent. This suggests someone forget to unlock an extent. INFO: task kwo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T15:41:06.977Z. Updated 2026-10-21T12:36:09.017Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:36 WIB

Official record

UnscoredPublished 01 Apr 2025, 22:41 WIB

CVE-2025-21941

drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params Null pointer dereference issue could occur when pipe_ctx->plane_state is null. The fix adds a check to ensure 'pipe_ctx->plane_state' is not null before access…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T15:41:06.489Z. Updated 2026-05-11T21:09:30.159Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:09 WIB

Official record

UnscoredPublished 01 Apr 2025, 22:41 WIB

CVE-2025-21940

drm/amdkfd: Fix NULL Pointer Dereference in KFD queue

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix NULL Pointer Dereference in KFD queue Through KFD IOCTL Fuzzing we encountered a NULL pointer derefrence when calling kfd_queue_acquire_buffers. (cherry picked from commit 049e5bf3c8406f87c3d8e1958e0a16804fa1d530)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T15:41:05.977Z. Updated 2026-05-11T21:09:28.926Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:09 WIB

Official record

HighPublished 01 Apr 2025, 22:41 WIB

CVE-2025-21939

drm/xe/hmm: Don't dereference struct page pointers without notifier lock

In the Linux kernel, the following vulnerability has been resolved: drm/xe/hmm: Don't dereference struct page pointers without notifier lock The pnfs that we obtain from hmm_range_fault() point to pages that we don't have a reference on, and the guarantee that they are still in the cpu page-tables is that the notifie…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T15:41:05.393Z. Updated 2026-10-15T21:51:55.851Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:51 WIB

Official record

HighPublished 01 Apr 2025, 22:41 WIB

CVE-2025-21938

mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr If multiple connection requests attempt to create an implicit mptcp endpoint in parallel, more than one caller may end up in mptcp_pm_nl_append_new_local_addr because none foun…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T15:41:04.886Z. Updated 2026-10-15T21:51:55.698Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:51 WIB

Official record

UnscoredPublished 01 Apr 2025, 22:41 WIB

CVE-2025-21937

Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name() Add check for the return value of mgmt_alloc_skb() in mgmt_remote_name() to prevent null pointer dereference.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T15:41:04.378Z. Updated 2026-05-23T15:57:28.874Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:57 WIB

Official record

UnscoredPublished 01 Apr 2025, 22:41 WIB

CVE-2025-21936

Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected() Add check for the return value of mgmt_alloc_skb() in mgmt_device_connected() to prevent null pointer dereference.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T15:41:03.845Z. Updated 2026-05-11T21:09:24.283Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:09 WIB

Official record

UnscoredPublished 01 Apr 2025, 22:41 WIB

CVE-2025-21935

rapidio: add check for rio_add_net() in rio_scan_alloc_net()

In the Linux kernel, the following vulnerability has been resolved: rapidio: add check for rio_add_net() in rio_scan_alloc_net() The return value of rio_add_net() should be checked. If it fails, put_device() should be called to free the memory and give up the reference initialized in rio_add_net().

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T15:41:03.335Z. Updated 2026-05-11T21:09:23.133Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:09 WIB

Official record

HighPublished 01 Apr 2025, 22:41 WIB

CVE-2025-21934

rapidio: fix an API misues when rio_add_net() fails

In the Linux kernel, the following vulnerability has been resolved: rapidio: fix an API misues when rio_add_net() fails rio_add_net() calls device_register() and fails when device_register() fails. Thus, put_device() should be used rather than kfree(). Add "mport->net = NULL;" to avoid a use after free issue.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T15:41:02.804Z. Updated 2026-08-05T11:55:27.199Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:55 WIB

Official record

UnscoredPublished 01 Apr 2025, 22:41 WIB

CVE-2025-21933

arm: pgtable: fix NULL pointer dereference issue

In the Linux kernel, the following vulnerability has been resolved: arm: pgtable: fix NULL pointer dereference issue When update_mmu_cache_range() is called by update_mmu_cache(), the vmf parameter is NULL, which will cause a NULL pointer dereference issue in adjust_pte(): Unable to handle kernel NULL pointer derefe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T15:41:02.300Z. Updated 2026-05-11T21:09:20.811Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:09 WIB

Official record

HighPublished 01 Apr 2025, 22:41 WIB

CVE-2025-21932

mm: abort vma_modify() on merge out of memory failure

In the Linux kernel, the following vulnerability has been resolved: mm: abort vma_modify() on merge out of memory failure The remainder of vma_modify() relies upon the vmg state remaining pristine after a merge attempt. Usually this is the case, however in the one edge case scenario of a merge attempt failing not du…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T15:41:01.792Z. Updated 2026-08-05T11:55:26.135Z.

CVSS7v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:55 WIB

Official record

UnscoredPublished 01 Apr 2025, 22:41 WIB

CVE-2025-21931

hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio

In the Linux kernel, the following vulnerability has been resolved: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio Commit b15c87263a69 ("hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined) add page poison checks in do_migrate_range in order to make offline hwpoisoned page possible by …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T15:41:01.055Z. Updated 2026-05-23T15:57:27.859Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:57 WIB

Official record