In 2025, 5,681 Linux kernel CVEs were published — the highest annual total ever recorded , representing 35% of all Linux kernel CVEs in history. Of these, 1 was rated Critical, 1,088 High severity , and 1 was confirmed as actively exploited in the wild via the CISA KEV catalog . A further 1,343 CVEs are still awaiting NVD severity scoring. Compared to 2024's 4,353 CVEs, 2025 represented an increase of 31% year-on-year. December was the most active month, with 1,055 CVEs published.
Monthly CVE Breakdown — 2025
CVEs published per month with severity breakdown
December (1,055) was the most active month in 2025. Together the top months account for a significant share of 2025's 5,681 total CVEs. November (104) had the lowest volume.
Severity Distribution — 2025
Breakdown across 5,681 CVEs
57% Medium · 19% High · 0% Critical. 1,343 CVEs (24%) still awaiting NVD scoring.
Monthly Counts — 2025
CVE counts by month and severity
December was the most active month with 1,055 CVEs — 19% of 2025's total. November (104) had the lowest volume.
| Month | Total | Critical | High | Medium | Low | Share of year |
|---|---|---|---|---|---|---|
| January | 223 | 0 | 50 | 172 | 1 |
4%
|
| February | 909 | 0 | 202 | 707 | 0 |
16%
|
| March | 208 | 0 | 42 | 164 | 2 |
4%
|
| April | 280 | 0 | 65 | 214 | 1 |
5%
|
| May | 549 | 0 | 127 | 422 | 0 |
10%
|
| June | 375 | 0 | 97 | 278 | 0 |
7%
|
| July | 401 | 0 | 120 | 281 | 0 |
7%
|
| August | 189 | 0 | 56 | 133 | 0 |
3%
|
| September | 737 | 0 | 210 | 527 | 0 |
13%
|
| October | 651 | 0 | 116 | 332 | 2 |
11%
|
| November | 104 | 0 | 1 | 1 | 0 |
2%
|
| December | 1,055 | 1 | 2 | 12 | 0 |
19%
|
| Total | 5,681 | 1 | 1,088 | 3,243 | 6 |
Actively exploited CVEs — 2025
1 CVE confirmed in CISA KEV catalog
All CVEs — 2025
5681 CVEs
| CVE ID | Package | Severity | CVSS | Published | Description | |
|---|---|---|---|---|---|---|
| CVE-2022-50879 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: objtool: Fix SEGFAULT find_insn() will return NULL … | |
| CVE-2022-50889 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: dm integrity: Fix UAF in dm_integrity_dtr() Dm_inte… | |
| CVE-2023-54194 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: exfat: use kvmalloc_array/kvfree instead of kmalloc… | |
| CVE-2022-50856 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifs_ses_add_channel() Before… | |
| CVE-2022-50786 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: media: s5p-mfc: Clear workbit to handle error condi… | |
| CVE-2023-54269 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: double free xprt_ctxt while still in use Wh… | |
| CVE-2023-54164 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix iso_conn related locking and va… | |
| CVE-2022-50813 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: drivers: mcb: fix resource leak in mcb_probe() When… | |
| CVE-2023-54222 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: hte: tegra-194: Fix off by one in tegra_hte_map_to_… | |
| CVE-2022-50843 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: dm clone: Fix UAF in clone_dtr() Dm_clone also has … |
2025 Linux Kernel CVE Highlights
-
Record year by a wide margin
2025's 5,681 CVEs make it the most prolific year in Linux kernel security history — 31% above 2024's 4,353 , representing 35% of all Linux kernel CVEs ever recorded across nearly 30 years of data . The jump primarily reflects the Linux kernel project's own CNA systematically backfilling and categorising previously unreported subsystem-level bugs.
-
Volume without critical severity
Despite setting the all-time CVE record, 2025 produced only 1 Critical-rated vulnerability. 57% of 2025 CVEs are Medium severity. This means the surge in raw numbers does not represent a proportional surge in high-severity risk.
-
Large backlog awaiting NVD scoring
1,343 of 2025's CVEs (24%) are still listed as "Awaiting NVD" — meaning no CVSS score has been assigned yet. This is typical for bulk-published CVEs from the Linux kernel CNA: the kernel team publishes CVEs rapidly, and NVD scoring lags by weeks or months.
-
Monthly variation
CVE publication in 2025 was uneven across months. December was the most active with 1,055 CVEs. November (104) had the lowest volume. Monthly spikes typically correspond to coordinated batches of backfilled CVEs being processed at once.