1017
CVEs
128
Critical
421
High
0
KEV
1
PoC
15
Unpatched C/H
97.4%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
128
HIGH
421
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (30)
Linux Kernel
6758
Debian Linux
1512
Ubuntu
550
Android
548
Ubuntu Linux
504
Enterprise Linux
265
Fedora
256
Opensuse
236
Leap
195
Enterprise Linux Server
135
Enterprise Linux Workstation
132
H410c Firmware
130
Enterprise Linux Desktop
130
H410s Firmware
119
H700s Firmware
119
H500s Firmware
119
Enterprise Linux Server Aus
119
H300s Firmware
118
Enterprise Linux Server Tus
91
Windows
78
Active Iq Unified Manager
78
Cloud Backup
75
Enterprise Linux Server Eus
69
H300E Firmware
68
H500E Firmware
68
H700E Firmware
68
Enterprise Linux Eus
65
Solidfire
58
Hci Management Node
57
Solaris
53
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-82017 | Boot registry parameter injection in IGEL OS 12 (before 12.7.6) and IGEL OS 11 (before 11.11.150) allows an attacker with physical access to execute arbitrary Linux kernel command-line parameters by writing to an unencrypted, unsigned configuration partition that the signed bootloader reads at startup. The attack is particularly dangerous because it does not alter the measured boot code path, meaning TPM PCR attestation does not detect the tampering - effectively defeating the trust assumptions of the secure boot and full-disk encryption stack. A publicly available exploit script and a DEF CON 34 presentation detail the technique; no CISA KEV listing has been issued at time of analysis, indicating exploitation has not been confirmed at scale. | HIGH | 8.6 | 0.2% | 63 |
PoC
|
| CVE-2026-74705 | Use-after-free in the Linux kernel's UDP tunnel GSO segmentation path (__skb_udp_tunnel_segment()) occurs when the code dereferences a saved UDP header pointer after a skb_pull() reallocates skb->head, invalidating that pointer. The flaw affects hosts that software-segment UDP-encapsulated tunnel traffic (VXLAN/GENEVE/FoU), and can lead to a kernel crash or potential information disclosure. No public exploit is identified at time of analysis, EPSS is low (0.22%), and the issue is not on CISA KEV; the upstream fix reorders the header fetch to occur after the pull. | CRITICAL | 10.0 | 0.2% | 50 |
|
| CVE-2026-74612 | Kernel memory disclosure and crash in the Linux kernel's veth driver arises from broken skb length accounting after an XDP program adjusts packet fragments; veth_xdp_rcv_skb() updates skb->data_len but leaves skb->len holding the stale fragment contribution, so skb_headlen() overstates the linear area. On the UDP receive path this caused __skb_datagram_iter() to copy 1024 bytes past the real linear tail into userspace - leaking skb_shared_info contents including nr_frags, xdp_frags_size, and a kernel pointer from frags[0] - while displacing and truncating real packet data. A related path via bpf_xdp_pull_data() leaves the skb non-linear and trips SKB_LINEAR_ASSERT(), crashing the kernel. There is no public exploit identified at time of analysis, and EPSS risk is low (0.21%). | CRITICAL | 10.0 | 0.2% | 50 |
|
| CVE-2026-74737 | Denial of service in the Linux kernel's TI AM65 CPSW NUSS Ethernet driver (am65-cpsw-nuss) allows sporadic kernel crashes because the driver treats the full 16-bit RX DMA descriptor Source Tag as the MAC port ID, when only the lower 8 bits are valid. On affected TI Sitara/K3 (AM65x-class) hardware, the arbitrary hardware-reserved upper 8 bits produce an invalid port_id that subsequent driver code uses to access out-of-bound memory, causing kernel panics. No public exploit is identified and it is not on CISA KEV; the vendor-tagged impact is Denial Of Service, not the remote code execution implied by the automated 9.8 score. | CRITICAL | 9.8 | 0.6% | 50 |
|
| CVE-2026-74746 | Use-after-free in the Linux kernel netfilter flowtable (nf_flow_table_offload) arises from an ordering bug in how connection-tracking tuple nodes are published to the rhashtable. Because nf_flow_table_iterate() treats only the original-direction node as the owning entry, publishing it before the reply node lets the garbage collector observe and free a flow while flow_offload_add() is still inserting the reply node, producing slab-use-after-free reads and writes reachable through rht_deferred_worker, jhash, flow_offload_del and flow_offload_lookup. The flaw affects systems using software/hardware flow offload; no public exploit identified at time of analysis, though the CNA-assigned CVSS is 9.8. | CRITICAL | 9.8 | 0.5% | 50 |
|
| CVE-2026-80528 | Denial of service (kernel crash/oops) in the Linux kernel CephFS client affects systems mounting a Ceph filesystem alongside another journaling filesystem such as ext4. The ceph handle_reply() path stores a ceph_mds_request pointer in current->journal_info while prepopulating the inode/dentry cache from an MDS reply; if an allocation in that window enters direct reclaim and prunes dentries from an ext4 mount, JBD2 misinterprets the Ceph pointer as a journal handle and dereferences r_tid as h_transaction, causing a paging fault and kernel oops. No KEV listing and no public exploit identified at time of analysis; the reported impact class is Denial Of Service rather than the code execution implied by the supplied 9.8 score. | CRITICAL | 9.8 | 0.5% | 50 |
|
| CVE-2026-80558 | Out-of-bounds memory access in the Linux kernel's libceph client (net/ceph) allows a malicious or corrupted Ceph osdmap to steer requests toward a non-existent OSD index. The flaw stems from an unvalidated osd index taken from the osdmap's primary_temp mapping, which is used to index the fixed-size osd_state, osd_weight, and osd_addr arrays. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed across multiple stable trees. | CRITICAL | 9.8 | 0.5% | 50 |
|
| CVE-2026-80561 | Slab-out-of-bounds reads in the Linux kernel's libceph client (cls_lock_client.c decode_locker()) allow a malicious or compromised Ceph OSD to read kernel memory past a validated buffer when a client parses lock information. Any kernel Ceph/RBD client that issues the lock.get_info class method - for example during RBD exclusive lock acquisition - is affected across a wide range of stable branches. The input assigns CVSS 9.8, but no public exploit identified at time of analysis and the flaw is an out-of-bounds read (information disclosure / crash) rather than confirmed code execution, so the practical impact is narrower than the score suggests. | CRITICAL | 9.8 | 0.5% | 50 |
|
| CVE-2026-74743 | Memory corruption in the Linux kernel's macvlan driver occurs because macvlan devices fail to inherit needed_headroom and needed_tailroom from their underlying lower device, leaving both at 0. On systems where a macvlan is stacked on a lower device requiring extra header/trailer space (macsec, IPsec, WireGuard, tunnels, or veth with RX headroom), the upper layers under-reserve skb space, producing headroom underflows and KASAN slab-use-after-free crashes during header insertion. Tagged as Denial Of Service; a vendor patch is available and no public exploit has been identified at time of analysis. | CRITICAL | 9.8 | 0.5% | 50 |
|
| CVE-2026-74744 | Memory corruption in the Linux kernel ipvlan driver arises because ipvlan devices inherit hard_header_len but leave needed_headroom and needed_tailroom at zero, so upper layers under-reserve skb space when the lower physical device needs extra header/trailer room (macsec, IPsec, WireGuard, tunnels, or veth with rx headroom). Triggering the header-prepend or tailroom-append path can cause skb headroom underflow and KASAN-detected slab-use-after-free crashes. It is tagged as Denial of Service, has a vendor fix across multiple stable branches, and shows no public exploit or CISA KEV listing at time of analysis. | CRITICAL | 9.8 | 0.5% | 50 |
|
| CVE-2026-74752 | Kernel memory corruption in the Linux SCTP stack allows a forged COOKIE_ECHO chunk to bypass validation of AUTH parameters when cookie authentication is disabled, letting an attacker who controls the echoed cookie bytes supply unchecked RANDOM lengths, HMAC identifiers, and CHUNKS lists. A forged RANDOM length yields out-of-bounds reads during key-vector construction, and a forged HMAC identifier drives a 32-byte write past a zero-length AUTH chunk - described by the reporter as a primitive for a local privilege escalation chain. No public exploit identified at time of analysis; the issue is fixed upstream in the mainline SCTP code. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-80586 | Uninitialized-data exposure in the Linux kernel's MPTCP (Multipath TCP) option parser lets a remote peer send a malformed DSS suboption with an incorrect size, followed by a second DSS or MPC+Data, causing the first suboption to be ignored while leaving stale fields populated. The kernel then acts on inconsistent or uninitialized memory when handling the MPTCP connection. The upstream fix explicitly resets the affected DSS fields; vendor stable patches are available, this maps to CWE-908/CWE-457 (use of uninitialized resource), and there is no public exploit identified at time of analysis. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-80589 | Use-after-free in the Linux kernel block layer occurs when a disk whose driver probe fails before add_disk() is released: disk_release() calls blk_mq_exit_queue() without stopping the request_queue timeout timer, so the request_queue is freed while still linked in a timer-wheel bucket. NVMe reaches this path because nvme_update_ns_info() issues Report Zones or FDP io-mgmt-recv I/O on the namespace queue before the disk is added, and a later failure (concurrent reset setting NVME_CTRL_FROZEN, or device_add_disk() failing) leaves the timer armed on freed memory. The flaw was found by the FuzzNvme fuzzer and produces a KASAN slab-use-after-free (write) during timer teardown; no public exploit is identified at time of analysis and it is not in CISA KEV. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-80587 | Improper handling of incoming MPTCP suboptions in the Linux kernel's Multipath TCP (mptcp) implementation lets a remote peer send option combinations that RFC 8684 treats as mutually exclusive and that the parsing code does not expect, potentially causing inconsistent internal state when malformed or malicious combinations (e.g. MP_CAPABLE with MP_JOIN, or MP_FASTCLOSE with a DSS) are processed on the receive path. The fix mirrors the output-side restrictions in mptcp_write_options so conflicting suboptions are ignored rather than acted upon. No public exploit identified at time of analysis, and the issue is only reachable on hosts where MPTCP is enabled and in use; the supplied CVSS of 9.8 appears automated and likely overstates real-world impact. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-74586 | A remotely triggerable use-after-free in the Linux kernel's SCTP stack (net/sctp) lets an authenticated SCTP peer read freed transport memory in sctp_outq_select_transport(). By sending an ASCONF chunk that both adds a peer transport and then removes it via a wildcard DEL-IP, the newly added transport is freed while asoc->new_transport still points to it; a later HEARTBEAT and address-replacement sequence dereferences the dangling pointer. There is no public exploit identified at time of analysis, EPSS is low (0.22%), and the flaw is not in CISA KEV, though a reliable private reproducer is described. | CRITICAL | 9.8 | 0.2% | 49 |
|