In 2019, 281 Linux kernel CVEs were published, sourced from the NIST National Vulnerability Database. Of these, 21 were rated Critical, 103 High severity , and 2 were confirmed as actively exploited in the wild (CISA KEV) . Compared to 2018's 174 CVEs, 2019 represented an increase of 61% year-on-year. November was the most active month, with 77 CVEs published.
Monthly CVE Breakdown — 2019
CVEs published per month with severity breakdown
November (77) was the most active month in 2019. Together the top months account for a significant share of 2019's 281 total CVEs. January (7) had the lowest volume.
Severity Distribution — 2019
Breakdown across 281 CVEs
52% Medium · 37% High · 7% Critical.
Monthly Counts — 2019
CVE counts by month and severity
November was the most active month with 77 CVEs — 27% of 2019's total. January (7) had the lowest volume.
| Month | Total | Critical | High | Medium | Low | Share of year |
|---|---|---|---|---|---|---|
| January | 7 | 0 | 2 | 5 | 0 |
2%
|
| February | 8 | 1 | 5 | 2 | 0 |
3%
|
| March | 7 | 1 | 2 | 4 | 0 |
2%
|
| April | 11 | 0 | 5 | 5 | 1 |
4%
|
| May | 16 | 1 | 6 | 8 | 1 |
6%
|
| June | 12 | 1 | 8 | 3 | 0 |
4%
|
| July | 21 | 5 | 8 | 7 | 1 |
7%
|
| August | 38 | 3 | 10 | 25 | 0 |
14%
|
| September | 34 | 2 | 14 | 17 | 1 |
12%
|
| October | 11 | 1 | 4 | 1 | 5 |
4%
|
| November | 77 | 6 | 29 | 41 | 1 |
27%
|
| December | 39 | 0 | 10 | 27 | 2 |
14%
|
| Total | 281 | 21 | 103 | 145 | 12 |
Actively exploited CVEs — 2019
2 CVEs confirmed in CISA KEV catalog
All CVEs — 2019
281 CVEs
| CVE ID | Package | Severity | CVSS | Published | Description | |
|---|---|---|---|---|---|---|
| CVE-2019-14897 | linux | Critical | 9.8 | 2019-11-29 | A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An att… | |
| CVE-2019-14895 | linux | Critical | 9.8 | 2019-11-29 | A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell… | |
| CVE-2019-14901 | linux | Critical | 9.8 | 2019-11-29 | A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip dr… | |
| CVE-2019-14896 | linux | Critical | 9.8 | 2019-11-27 | A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip d… | |
| CVE-2019-18805 | linux | Critical | 9.8 | 2019-11-07 | An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.… | |
| CVE-2019-18814 | linux | Critical | 9.8 | 2019-11-07 | An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-free when aa_label_parse() fails in aa_… | |
| CVE-2019-17133 | linux | Critical | 9.8 | 2019-10-04 | In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE… | |
| CVE-2019-16746 | linux | Critical | 9.8 | 2019-09-24 | An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of v… | |
| CVE-2019-15505 | linux | Critical | 9.8 | 2019-08-23 | drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB … | |
| CVE-2019-15504 | linux | Critical | 9.8 | 2019-08-23 | drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel through 5.2.9 has a Double Free via crafted USB device traff… |
2019 Linux Kernel CVE Highlights
-
Monthly variation
CVE publication in 2019 was uneven across months. November was the most active with 77 CVEs. January (7) had the lowest volume. Monthly spikes typically correspond to coordinated batches of backfilled CVEs being processed at once.