In 2025, 5,681 Linux kernel CVEs were published, sourced from the NIST National Vulnerability Database. Of these, 47 were rated Critical, 1,489 High severity , and 3 were confirmed as actively exploited in the wild (CISA KEV) . Compared to 2024's 4,355 CVEs, 2025 represented an increase of 30% year-on-year. December was the most active month, with 1,055 CVEs published.
Monthly CVE Breakdown — 2025
CVEs published per month with severity breakdown
December (1,055) was the most active month in 2025. Together the top months account for a significant share of 2025's 5,681 total CVEs. November (104) had the lowest volume.
Severity Distribution — 2025
Breakdown across 5,681 CVEs
57% Medium · 26% High · 1% Critical. 897 CVEs (16%) still awaiting NVD scoring.
Monthly Counts — 2025
CVE counts by month and severity
December was the most active month with 1,055 CVEs — 19% of 2025's total. November (104) had the lowest volume.
| Month | Total | Critical | High | Medium | Low | Share of year |
|---|---|---|---|---|---|---|
| January | 223 | 0 | 50 | 172 | 1 |
4%
|
| February | 909 | 3 | 199 | 707 | 0 |
16%
|
| March | 208 | 0 | 42 | 164 | 2 |
4%
|
| April | 280 | 1 | 65 | 213 | 1 |
5%
|
| May | 549 | 0 | 127 | 422 | 0 |
10%
|
| June | 375 | 0 | 97 | 278 | 0 |
7%
|
| July | 401 | 0 | 120 | 281 | 0 |
7%
|
| August | 189 | 0 | 56 | 133 | 0 |
3%
|
| September | 737 | 1 | 209 | 527 | 0 |
13%
|
| October | 651 | 3 | 193 | 333 | 1 |
11%
|
| November | 104 | 2 | 42 | 1 | 0 |
2%
|
| December | 1,055 | 37 | 289 | 12 | 0 |
19%
|
| Total | 5,681 | 47 | 1,489 | 3,243 | 5 |
Actively exploited CVEs — 2025
3 CVEs confirmed in CISA KEV catalog
All CVEs — 2025
5681 CVEs
| CVE ID | Package | Severity | CVSS | Published | Description | |
|---|---|---|---|---|---|---|
| CVE-2023-54224 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix lockdep splat and potential deadlock aft… | |
| CVE-2023-54263 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR D… | |
| CVE-2023-54213 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: USB: sisusbvga: Add endpoint checks The syzbot fuzz… | |
| CVE-2023-54299 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: bus: verify partner exists in typec_alt… | |
| CVE-2023-54180 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: btrfs: handle case when repair happens with dev-rep… | |
| CVE-2023-54251 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCL… | |
| CVE-2022-50809 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: xhci: dbc: Fix memory leak in xhci_alloc_dbc() If D… | |
| CVE-2023-54294 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix memleak of md thread In raid10_run()… | |
| CVE-2022-50849 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: pstore: Avoid kcore oops by vmap()ing with VM_IOREM… | |
| CVE-2023-54174 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: vfio: Fix NULL pointer dereference caused by uninit… |
2025 Linux Kernel CVE Highlights
-
Large backlog awaiting NVD scoring
897 of 2025's CVEs (16%) are still listed as "Awaiting NVD" — meaning no CVSS score has been assigned yet. This is typical for bulk-published CVEs from the Linux kernel CNA: the kernel team publishes CVEs rapidly, and NVD scoring lags by weeks or months.
-
Monthly variation
CVE publication in 2025 was uneven across months. December was the most active with 1,055 CVEs. November (104) had the lowest volume. Monthly spikes typically correspond to coordinated batches of backfilled CVEs being processed at once.