Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 3301–3320 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

UnscoredPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38214

fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var

In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var If fb_add_videomode() in fb_set_var() fails to allocate memory for fb_videomode, later it may lead to a null-ptr dereference in fb_videomode_to_var(), as the fb_info is registered…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:32.410Z. Updated 2026-10-15T01:06:49.281Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:06 WIB

Official record

HighPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38212

ipc: fix to protect IPCS lookups using RCU

In the Linux kernel, the following vulnerability has been resolved: ipc: fix to protect IPCS lookups using RCU syzbot reported that it discovered a use-after-free vulnerability, [0] [0]: https://lore.kernel.org/all/67af13f8.050a0220.21dd3.0038.GAE@google.com/ idr_for_each() is protected by rwsem, but this is not en…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3301 to 3320 of 3774.First page Next page

Published 2025-07-04T13:37:30.957Z. Updated 2026-10-15T21:52:11.622Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:52 WIB

Official record

CritPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38211

RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction

In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction The commit 59c68ac31e15 ("iw_cm: free cm_id resources on the last deref") simplified cm_id resource management by freeing cm_id once all references to the cm_id were removed. The r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:30.307Z. Updated 2026-08-05T12:00:23.526Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:00 WIB

Official record

UnscoredPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38210

configfs-tsm-report: Fix NULL dereference of tsm_ops

In the Linux kernel, the following vulnerability has been resolved: configfs-tsm-report: Fix NULL dereference of tsm_ops Unlike sysfs, the lifetime of configfs objects is controlled by userspace. There is no mechanism for the kernel to find and delete all created config-items. Instead, the configfs-tsm-report mechani…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:29.663Z. Updated 2026-05-11T21:23:23.157Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:23 WIB

Official record

CritPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38209

nvme-tcp: remove tag set when second admin queue config fails

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: remove tag set when second admin queue config fails Commit 104d0e2f6222 ("nvme-fabrics: reset admin connection for secure concatenation") modified nvme_tcp_setup_ctrl() to call nvme_tcp_configure_admin_queue() twice. The first call prepares…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:28.853Z. Updated 2026-10-15T21:52:11.489Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:52 WIB

Official record

UnscoredPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38208

smb: client: add NULL check in automount_fullpath

In the Linux kernel, the following vulnerability has been resolved: smb: client: add NULL check in automount_fullpath page is checked for null in __build_path_from_dentry_optional_prefix when tcon->origin_fullpath is not set. However, the check is missing when it is set. Add a check to prevent a potential NULL pointe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:28.226Z. Updated 2026-05-23T15:59:12.615Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:59 WIB

Official record

UnscoredPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38207

mm: fix uprobe pte be overwritten when expanding vma

In the Linux kernel, the following vulnerability has been resolved: mm: fix uprobe pte be overwritten when expanding vma Patch series "Fix uprobe pte be overwritten when expanding vma". This patch (of 4): We encountered a BUG alert triggered by Syzkaller as follows: BUG: Bad rss-counter state mm:00000000b4a60fc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:27.508Z. Updated 2026-10-21T12:36:52.413Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:36 WIB

Official record

HighPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38206

exfat: fix double free in delayed_free

In the Linux kernel, the following vulnerability has been resolved: exfat: fix double free in delayed_free The double free could happen in the following path. exfat_create_upcase_table() exfat_create_upcase_table() : return error exfat_free_upcase_table() : free ->vol_utbl exfat_load_default_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:25.966Z. Updated 2026-09-02T12:49:18.688Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated02 Sep 2026, 19:49 WIB

Official record

UnscoredPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38205

drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 [Why] If the dummy values in `populate_dummy_dml_surface_cfg()` aren't updated then they can lead to a divide by zero in downstream callers like CalculateVMAndRowBytes() [How] In…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:25.242Z. Updated 2026-09-07T15:44:46.431Z.

CVSS—KEVNot listedEPSSPresentUpdated07 Sep 2026, 22:44 WIB

Official record

HighPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38204

jfs: fix array-index-out-of-bounds read in add_missing_indices

In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds read in add_missing_indices stbl is s8 but it must contain offsets into slot which can go from 0 to 127. Added a bound check for that error and return -EIO if the check fails. Also make jfs_readdir return with erro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:24.606Z. Updated 2026-10-21T12:36:51.285Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:36 WIB

Official record

UnscoredPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38203

jfs: Fix null-ptr-deref in jfs_ioc_trim

In the Linux kernel, the following vulnerability has been resolved: jfs: Fix null-ptr-deref in jfs_ioc_trim [ Syzkaller Report ] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000087: 0000 [#1 KASAN: null-ptr-deref in range [0x0000000000000438-0x000000000000043f] CPU: 2 UID: 0 PID: 10…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:23.975Z. Updated 2026-09-02T12:49:17.628Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Sep 2026, 19:49 WIB

Official record

UnscoredPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38202

bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()

In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() bpf_map_lookup_percpu_elem() helper is also available for sleepable bpf program. When BPF JIT is disabled or under 32-bit host, bpf_map_lookup_percpu_elem() will not be inlined. Us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:23.347Z. Updated 2026-05-11T21:23:13.711Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:23 WIB

Official record

UnscoredPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38201

netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. Similar to: b541ba7d1f5a ("netfilter: conntrack: …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:22.732Z. Updated 2026-10-15T01:06:46.313Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:06 WIB

Official record

UnscoredPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38200

i40e: fix MMIO write access to an invalid page in i40e_clear_hw

In the Linux kernel, the following vulnerability has been resolved: i40e: fix MMIO write access to an invalid page in i40e_clear_hw When the device sends a specific input, an integer underflow can occur, leading to MMIO write access to an invalid page. Prevent the integer underflow by changing the type of related va…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:22.076Z. Updated 2026-06-11T18:44:12.667Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Jun 2026, 01:44 WIB

Official record

UnscoredPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38199

wifi: ath12k: Fix memory leak due to multiple rx_stats allocation

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix memory leak due to multiple rx_stats allocation rx_stats for each arsta is allocated when adding a station. arsta->rx_stats will be freed when a station is removed. Redundant allocations are occurring when the same station is added…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:21.227Z. Updated 2026-10-21T12:36:50.145Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:36 WIB

Official record

UnscoredPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38198

fbcon: Make sure modelist not set on unregistered console

In the Linux kernel, the following vulnerability has been resolved: fbcon: Make sure modelist not set on unregistered console It looks like attempting to write to the "store_modes" sysfs node will run afoul of unregistered consoles: UBSAN: array-index-out-of-bounds in drivers/video/fbdev/core/fbcon.c:122:28 index -1…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:20.588Z. Updated 2026-10-15T01:06:44.445Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:06 WIB

Official record

HighPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38197

platform/x86: dell_rbu: Fix list usage

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell_rbu: Fix list usage Pass the correct list head to list_for_each_entry*() when looping through the packet list. Without this patch, reading the packet data via sysfs will show the data incorrectly (because it starts at the wrong pa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:19.926Z. Updated 2026-10-15T21:52:11.150Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:52 WIB

Official record

UnscoredPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38196

io_uring/rsrc: validate buffer count with offset for cloning

In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: validate buffer count with offset for cloning syzbot reports that it can trigger a WARN_ON() for kmalloc() attempt that's too big: WARNING: CPU: 0 PID: 6488 at mm/slub.c:5024 __kvmalloc_node_noprof+0x520/0x640 mm/slub.c:5024 Modules l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:19.191Z. Updated 2026-05-11T21:23:06.676Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:23 WIB

Official record

UnscoredPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38195

LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() ERROR INFO: CPU 25 Unable to handle kernel paging request at virtual address 0x0 ... Call Trace: [<900000000023c30c>] huge_pte_offset+0x3c/0x58 [<900000000057fd4c>] hugetlb_fol…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:18.558Z. Updated 2026-05-23T15:59:11.552Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:59 WIB

Official record

UnscoredPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38194

jffs2: check that raw node were preallocated before writing summary

In the Linux kernel, the following vulnerability has been resolved: jffs2: check that raw node were preallocated before writing summary Syzkaller detected a kernel bug in jffs2_link_node_ref, caused by fault injection in jffs2_prealloc_raw_node_refs. jffs2_sum_write_sumnode doesn't check return value of jffs2_preallo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:17.922Z. Updated 2026-05-11T21:23:04.119Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:23 WIB

Official record