In 2023, 265 Linux kernel CVEs were published, sourced from the NIST National Vulnerability Database. Of these, 7 were rated Critical, 120 High severity , and 2 were confirmed as actively exploited in the wild (CISA KEV) . Compared to 2022's 279 CVEs, 2023 represented a decrease of 5% year-on-year. March was the most active month, with 42 CVEs published.
Monthly CVE Breakdown — 2023
CVEs published per month with severity breakdown
March (42) was the most active month in 2023. Together the top months account for a significant share of 2023's 265 total CVEs. December (11) had the lowest volume.
Severity Distribution — 2023
Breakdown across 265 CVEs
51% Medium · 45% High · 3% Critical.
Monthly Counts — 2023
CVE counts by month and severity
March was the most active month with 42 CVEs — 16% of 2023's total. December (11) had the lowest volume.
| Month | Total | Critical | High | Medium | Low | Share of year |
|---|---|---|---|---|---|---|
| January | 19 | 0 | 10 | 9 | 0 |
7%
|
| February | 16 | 0 | 7 | 9 | 0 |
6%
|
| March | 42 | 0 | 21 | 19 | 2 |
16%
|
| April | 29 | 0 | 8 | 21 | 0 |
11%
|
| May | 18 | 0 | 6 | 12 | 0 |
7%
|
| June | 30 | 0 | 17 | 13 | 0 |
11%
|
| July | 38 | 7 | 18 | 13 | 0 |
14%
|
| August | 13 | 0 | 4 | 9 | 0 |
5%
|
| September | 17 | 0 | 12 | 4 | 1 |
6%
|
| October | 18 | 0 | 6 | 12 | 0 |
7%
|
| November | 14 | 0 | 5 | 9 | 0 |
5%
|
| December | 11 | 0 | 6 | 5 | 0 |
4%
|
| Total | 265 | 7 | 120 | 135 | 3 |
Actively exploited CVEs — 2023
2 CVEs confirmed in CISA KEV catalog
All CVEs — 2023
265 CVEs
| CVE ID | Package | Severity | CVSS | Published | Description | |
|---|---|---|---|---|---|---|
| CVE-2023-38429 | linux | Critical | 9.8 | 2023-07-18 | An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c in ksmbd has an off-by-one error in mem… | |
| CVE-2023-38427 | linux | Critical | 9.8 | 2023-07-18 | An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu.c in ksmbd has an integer underflow and… | |
| CVE-2023-38432 | linux | Critical | 9.1 | 2023-07-18 | An issue was discovered in the Linux kernel before 6.3.10. fs/smb/server/smb2misc.c in ksmbd does not validate the rela… | |
| CVE-2023-38428 | linux | Critical | 9.1 | 2023-07-18 | An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly check the UserN… | |
| CVE-2023-38430 | linux | Critical | 9.1 | 2023-07-18 | An issue was discovered in the Linux kernel before 6.3.9. ksmbd does not validate the SMB request protocol ID, leading … | |
| CVE-2023-38431 | linux | Critical | 9.1 | 2023-07-18 | An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/connection.c in ksmbd does not validate the rel… | |
| CVE-2023-38426 | linux | Critical | 9.1 | 2023-07-18 | An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in smb2_find_context_vals whe… | |
| CVE-2023-5178 | linux | High | 8.8 | 2023-11-01 | A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug … | |
| CVE-2023-44466 | linux | High | 8.8 | 2023-09-29 | An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel before 6.4.5. There is an integer signedness err… | |
| CVE-2023-2163 | linux | High | 8.8 | 2023-09-20 | Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe, re… |
2023 Linux Kernel CVE Highlights
-
Monthly variation
CVE publication in 2023 was uneven across months. March was the most active with 42 CVEs. December (11) had the lowest volume. Monthly spikes typically correspond to coordinated batches of backfilled CVEs being processed at once.