Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,980 published records · 19 KEV · 3,980 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,980 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2446.1%
High95724%
Med1,53639%
Low1193.0%
None00.00%
Legacy00.00%
Unscored1,12428%

Matching records by UTC month

May 253,980

Signal coverage

KEV-listed: 19
With a forecast: 3,980
Unknown date: 0
Unscored severity: 1,124

Share of cohort: KEV 0.48% · forecast 100% · unscored 28%.

Showing 981–1000 of 3,980By severity band: Critical · 9.0–10.0 244, High · 7.0–8.9 957, Medium · 4.0–6.9 1,536, Low · 0.1–3.9 119, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,124

UnscoredPublished 20 May 2025, 23:47 WIB

CVE-2025-37972

Input: mtk-pmic-keys - fix possible null pointer dereference

In the Linux kernel, the following vulnerability has been resolved: Input: mtk-pmic-keys - fix possible null pointer dereference In mtk_pmic_keys_probe, the regs parameter is only set if the button is parsed in the device tree. However, on hardware where the button is left floating, that node will most likely be remo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-20T16:47:18.481Z. Updated 2026-10-15T01:06:19.922Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:06 WIB

Official record

UnscoredPublished 20 May 2025, 23:47 WIB

CVE-2025-37971

staging: bcm2835-camera: Initialise dev in v4l2_dev

In the Linux kernel, the following vulnerability has been resolved: staging: bcm2835-camera: Initialise dev in v4l2_dev Commit 42a2f6664e18 ("staging: vc04_services: Move global g_state to vchiq_state") changed mmal_init to pass dev->v4l2_dev.dev to vchiq_mmal_init, however nothing iniitialised dev->v4l2_dev, so we g…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 981 to 1000 of 3980.First page Next page

Published 2025-05-20T16:47:17.879Z. Updated 2026-05-11T21:18:47.057Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:18 WIB

Official record

UnscoredPublished 20 May 2025, 23:47 WIB

CVE-2025-37970

iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo

In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo Prevent st_lsm6dsx_read_fifo from falling in an infinite loop in case pattern_len is equal to zero and the device FIFO is not empty.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-20T16:47:17.256Z. Updated 2026-05-11T21:18:45.901Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:18 WIB

Official record

UnscoredPublished 20 May 2025, 23:47 WIB

CVE-2025-37969

iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo

In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo Prevent st_lsm6dsx_read_tagged_fifo from falling in an infinite loop in case pattern_len is equal to zero and the device FIFO is not empty.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-20T16:47:16.641Z. Updated 2026-05-11T21:18:44.467Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:18 WIB

Official record

UnscoredPublished 20 May 2025, 23:47 WIB

CVE-2025-37968

iio: light: opt3001: fix deadlock due to concurrent flag access

In the Linux kernel, the following vulnerability has been resolved: iio: light: opt3001: fix deadlock due to concurrent flag access The threaded IRQ function in this driver is reading the flag twice: once to lock a mutex and once to unlock it. Even though the code setting the flag is designed to prevent it, there are…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-20T16:47:16.051Z. Updated 2026-05-12T12:04:21.741Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:04 WIB

Official record

UnscoredPublished 20 May 2025, 23:47 WIB

CVE-2025-37967

usb: typec: ucsi: displayport: Fix deadlock

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix deadlock This patch introduces the ucsi_con_mutex_lock / ucsi_con_mutex_unlock functions to the UCSI driver. ucsi_con_mutex_lock ensures the connector mutex is only locked if a connection is established and the part…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-20T16:47:15.473Z. Updated 2026-05-11T21:18:42.177Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:18 WIB

Official record

UnscoredPublished 20 May 2025, 23:47 WIB

CVE-2025-37966

riscv: Fix kernel crash due to PR_SET_TAGGED_ADDR_CTRL

In the Linux kernel, the following vulnerability has been resolved: riscv: Fix kernel crash due to PR_SET_TAGGED_ADDR_CTRL When userspace does PR_SET_TAGGED_ADDR_CTRL, but Supm extension is not available, the kernel crashes: Oops - illegal instruction [#1] [snip] epc : set_tagged_addr_ctrl+0x112/0x15a ra : set_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-20T16:47:14.815Z. Updated 2026-05-11T21:18:41.061Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:18 WIB

Official record

UnscoredPublished 20 May 2025, 23:47 WIB

CVE-2025-37965

drm/amd/display: Fix invalid context error in dml helper

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix invalid context error in dml helper [Why] "BUG: sleeping function called from invalid context" error. after: "drm/amd/display: Protect FPU in dml2_validate()/dml21_validate()" The populate_dml_plane_cfg_from_plane_state() uses t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-20T16:47:14.179Z. Updated 2026-05-11T21:18:39.921Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:18 WIB

Official record

HighPublished 20 May 2025, 23:01 WIB

CVE-2025-37964

x86/mm: Eliminate window where TLB flushes may be inadvertently skipped

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Eliminate window where TLB flushes may be inadvertently skipped tl;dr: There is a window in the mm switching code where the new CR3 is set and the CPU should be getting TLB flushes for the new mm. But should_flush_tlb() has a bug and suppres…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-20T16:01:56.013Z. Updated 2026-10-15T01:06:18.215Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:06 WIB

Official record

UnscoredPublished 20 May 2025, 23:01 WIB

CVE-2025-37963

arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users

In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users Support for eBPF programs loaded by unprivileged users is typically disabled. This means only cBPF programs need to be mitigated for BHB. In addition, only mitigate cBPF programs t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-20T16:01:55.322Z. Updated 2026-05-11T21:18:37.576Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:18 WIB

Official record

UnscoredPublished 20 May 2025, 23:01 WIB

CVE-2025-37962

ksmbd: fix memory leak in parse_lease_state()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix memory leak in parse_lease_state() The previous patch that added bounds check for create lease context introduced a memory leak. When the bounds check fails, the function returns NULL without freeing the previously allocated lease_ctx_info…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-20T16:01:54.612Z. Updated 2026-05-23T15:58:41.897Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:58 WIB

Official record

UnscoredPublished 20 May 2025, 23:01 WIB

CVE-2025-37961

ipvs: fix uninit-value for saddr in do_output_route4

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix uninit-value for saddr in do_output_route4 syzbot reports for uninit-value for the saddr argument [1]. commit 4754957f04f5 ("ipvs: do not use random local source address for tunnels") already implies that the input value of saddr should be …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-20T16:01:53.940Z. Updated 2026-05-23T15:58:40.848Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:58 WIB

Official record

UnscoredPublished 20 May 2025, 23:01 WIB

CVE-2025-37960

memblock: Accept allocated memory before use in memblock_double_array()

In the Linux kernel, the following vulnerability has been resolved: memblock: Accept allocated memory before use in memblock_double_array() When increasing the array size in memblock_double_array() and the slab is not yet available, a call to memblock_find_in_range() is used to reserve/allocate memory. However, the r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-20T16:01:53.264Z. Updated 2026-05-11T21:18:25.936Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:18 WIB

Official record

CritPublished 20 May 2025, 23:01 WIB

CVE-2025-37959

bpf: Scrub packet on bpf_redirect_peer

In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub packet on bpf_redirect_peer When bpf_redirect_peer is used to redirect packets to a device in another network namespace, the skb isn't scrubbed. That can lead skb information from one namespace to be "misused" in another namespace. As one…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-20T16:01:52.547Z. Updated 2026-10-15T21:52:05.352Z.

CVSS9.4v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:52 WIB

Official record

UnscoredPublished 20 May 2025, 23:01 WIB

CVE-2025-37958

mm/huge_memory: fix dereferencing invalid pmd migration entry

In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix dereferencing invalid pmd migration entry When migrating a THP, concurrent access to the PMD migration entry during a deferred split scan can lead to an invalid address access, as illustrated below. To prevent this invalid access…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-20T16:01:51.740Z. Updated 2026-05-11T21:18:23.635Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:18 WIB

Official record

HighPublished 20 May 2025, 23:01 WIB

CVE-2025-37957

KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception Previously, commit ed129ec9057f ("KVM: x86: forcibly leave nested mode on vCPU reset") addressed an issue where a triple fault occurring in nested mode could lead to use-after-free scenarios.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-20T16:01:50.878Z. Updated 2026-10-15T21:52:05.202Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:52 WIB

Official record

HighPublished 20 May 2025, 23:01 WIB

CVE-2025-37956

ksmbd: prevent rename with empty string

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent rename with empty string Client can send empty newname string to ksmbd server. It will cause a kernel oops from d_alloc. This patch return the error when attempting to rename a file or directory with an empty new name string.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-20T16:01:49.865Z. Updated 2026-08-05T11:58:38.144Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:58 WIB

Official record

UnscoredPublished 20 May 2025, 23:01 WIB

CVE-2025-37955

virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable()

In the Linux kernel, the following vulnerability has been resolved: virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() The selftests added to our CI by Bui Quang Minh recently reveals that there is a mem leak on the error path of virtnet_xsk_pool_enable(): unreferenced object 0xffff88800a68a000 (size 2…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-20T16:01:49.209Z. Updated 2026-05-11T21:18:20.158Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:18 WIB

Official record

HighPublished 20 May 2025, 23:01 WIB

CVE-2025-37954

smb: client: Avoid race in open_cached_dir with lease breaks

In the Linux kernel, the following vulnerability has been resolved: smb: client: Avoid race in open_cached_dir with lease breaks A pre-existing valid cfid returned from find_or_create_cached_dir might race with a lease break, meaning open_cached_dir doesn't consider it valid, and thinks it's newly-constructed. This l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-20T16:01:48.561Z. Updated 2026-10-15T21:52:05.057Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:52 WIB

Official record

UnscoredPublished 20 May 2025, 23:01 WIB

CVE-2025-37953

sch_htb: make htb_deactivate() idempotent

In the Linux kernel, the following vulnerability has been resolved: sch_htb: make htb_deactivate() idempotent Alan reported a NULL pointer dereference in htb_next_rb_node() after we made htb_qlen_notify() idempotent. It turns out in the following case it introduced some regression: htb_dequeue_tree(): |-> fq_code…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-20T16:01:47.818Z. Updated 2026-05-11T21:18:17.815Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:18 WIB

Official record