In 2016, 189 Linux kernel CVEs were published, sourced from the NIST National Vulnerability Database. Of these, 6 were rated Critical, 80 High severity , and 1 was confirmed as actively exploited in the wild (CISA KEV) . Compared to 2015's 81 CVEs, 2016 represented an increase of 133% year-on-year. May was the most active month, with 51 CVEs published.
Monthly CVE Breakdown — 2016
CVEs published per month with severity breakdown
May (51) was the most active month in 2016. Together the top months account for a significant share of 2016's 189 total CVEs. March (2) had the lowest volume.
Severity Distribution — 2016
Breakdown across 189 CVEs
54% Medium · 42% High · 3% Critical.
Monthly Counts — 2016
CVE counts by month and severity
May was the most active month with 51 CVEs — 27% of 2016's total. March (2) had the lowest volume.
| Month | Total | Critical | High | Medium | Low | Share of year |
|---|---|---|---|---|---|---|
| February | 12 | 1 | 3 | 8 | 0 |
6%
|
| March | 2 | 0 | 0 | 2 | 0 |
1%
|
| April | 30 | 1 | 6 | 23 | 0 |
16%
|
| May | 51 | 0 | 23 | 27 | 1 |
27%
|
| June | 14 | 0 | 9 | 5 | 0 |
7%
|
| July | 4 | 1 | 2 | 1 | 0 |
2%
|
| August | 17 | 1 | 6 | 10 | 0 |
9%
|
| October | 14 | 1 | 4 | 9 | 0 |
7%
|
| November | 28 | 1 | 14 | 13 | 0 |
15%
|
| December | 17 | 0 | 13 | 4 | 0 |
9%
|
| Total | 189 | 6 | 80 | 102 | 1 |
Actively exploited CVEs — 2016
1 CVE confirmed in CISA KEV catalog
All CVEs — 2016
189 CVEs
| CVE ID | Package | Severity | CVSS | Published | Description | |
|---|---|---|---|---|---|---|
| CVE-2016-9555 | linux | Critical | 9.8 | 2016-11-28 | The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length checking for t… | |
| CVE-2016-7117 | linux | Critical | 9.8 | 2016-10-10 | Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel before 4.5.2 allows rem… | |
| CVE-2014-9410 | linux | Critical | 9.8 | 2016-08-07 | The vfe31_proc_general function in drivers/media/video/msm/vfe/msm_vfe31.c in the MSM-VFE31 driver for the Linux kernel… | |
| CVE-2016-3955 | linux | Critical | 9.8 | 2016-07-03 | The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows remote attack… | |
| CVE-2015-8812 | linux | Critical | 9.8 | 2016-04-27 | drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel before 4.5 does not properly identify error conditions, which… | |
| CVE-2015-8787 | linux | Critical | 9.8 | 2016-02-08 | The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linux kernel before 4.4 allows remote attac… | |
| CVE-2016-3134 | linux | High | 8.4 | 2016-04-27 | The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, which allows local u… | |
| CVE-2012-6704 | linux | High | 7.8 | 2016-12-28 | The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5 mishandles negative values of sk_sndbuf … | |
| CVE-2016-9777 | linux | High | 7.8 | 2016-12-28 | KVM in the Linux kernel before 4.8.12, when I/O APIC is enabled, does not properly restrict the VCPU index, which allow… | |
| CVE-2016-9794 | linux | High | 7.8 | 2016-12-28 | Race condition in the snd_pcm_period_elapsed function in sound/core/pcm_lib.c in the ALSA subsystem in the Linux kernel… |
2016 Linux Kernel CVE Highlights
-
Monthly variation
CVE publication in 2016 was uneven across months. May was the most active with 51 CVEs. March (2) had the lowest volume. Monthly spikes typically correspond to coordinated batches of backfilled CVEs being processed at once.