In 2025, 5,681 Linux kernel CVEs were published — the highest annual total ever recorded , representing 31% of all Linux kernel CVEs in history. Of these, 46 were rated Critical, 1,489 High severity , and 1 was confirmed as actively exploited in the wild via the CISA KEV catalog . A further 897 CVEs are still awaiting NVD severity scoring. Compared to 2024's 4,353 CVEs, 2025 represented an increase of 31% year-on-year. December was the most active month, with 1,055 CVEs published.
Monthly CVE Breakdown — 2025
CVEs published per month with severity breakdown
December (1,055) was the most active month in 2025. Together the top months account for a significant share of 2025's 5,681 total CVEs. November (104) had the lowest volume.
Severity Distribution — 2025
Breakdown across 5,681 CVEs
57% Medium · 26% High · 1% Critical. 897 CVEs (16%) still awaiting NVD scoring.
Monthly Counts — 2025
CVE counts by month and severity
December was the most active month with 1,055 CVEs — 19% of 2025's total. November (104) had the lowest volume.
| Month | Total | Critical | High | Medium | Low | Share of year |
|---|---|---|---|---|---|---|
| January | 223 | 0 | 50 | 172 | 1 |
4%
|
| February | 909 | 3 | 199 | 707 | 0 |
16%
|
| March | 208 | 0 | 42 | 164 | 2 |
4%
|
| April | 280 | 1 | 64 | 214 | 1 |
5%
|
| May | 549 | 0 | 127 | 422 | 0 |
10%
|
| June | 375 | 0 | 97 | 278 | 0 |
7%
|
| July | 401 | 0 | 120 | 281 | 0 |
7%
|
| August | 189 | 0 | 56 | 133 | 0 |
3%
|
| September | 737 | 0 | 210 | 527 | 0 |
13%
|
| October | 651 | 3 | 193 | 332 | 2 |
11%
|
| November | 104 | 2 | 42 | 1 | 0 |
2%
|
| December | 1,055 | 37 | 289 | 12 | 0 |
19%
|
| Total | 5,681 | 46 | 1,489 | 3,243 | 6 |
Actively exploited CVEs — 2025
1 CVE confirmed in CISA KEV catalog
All CVEs — 2025
5681 CVEs
| CVE ID | Package | Severity | CVSS | Published | Description | |
|---|---|---|---|---|---|---|
| CVE-2023-54324 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: dm: fix a race condition in retrieve_deps There's a… | |
| CVE-2023-54205 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: stm32: Fix refcount leak in stm32_pctrl_ge… | |
| CVE-2023-54179 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Array index may go out of bound Kloc… | |
| CVE-2023-54208 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: media: ov5675: Fix memleak in ov5675_init_controls(… | |
| CVE-2023-54170 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: keys: Fix linking a duplicate key to a keyring's as… | |
| CVE-2023-54190 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: leds: led-core: Fix refcount leak in of_led_get() c… | |
| CVE-2023-54266 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: m920x: Fix a potential memory leak … | |
| CVE-2023-54282 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: media: tuners: qt1010: replace BUG_ON with a regula… | |
| CVE-2022-50858 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: mmc: alcor: fix return value check of mmc_add_host(… | |
| CVE-2023-54167 | linux | Awaiting NVD | — | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: m68k: mm: Move initrd phys_to_virt handling after p… |
2025 Linux Kernel CVE Highlights
-
Record year by a wide margin
2025's 5,681 CVEs make it the most prolific year in Linux kernel security history — 31% above 2024's 4,353 , representing 31% of all Linux kernel CVEs ever recorded across nearly 30 years of data . The jump primarily reflects the Linux kernel project's own CNA systematically backfilling and categorising previously unreported subsystem-level bugs.
-
Large backlog awaiting NVD scoring
897 of 2025's CVEs (16%) are still listed as "Awaiting NVD" — meaning no CVSS score has been assigned yet. This is typical for bulk-published CVEs from the Linux kernel CNA: the kernel team publishes CVEs rapidly, and NVD scoring lags by weeks or months.
-
Monthly variation
CVE publication in 2025 was uneven across months. December was the most active with 1,055 CVEs. November (104) had the lowest volume. Monthly spikes typically correspond to coordinated batches of backfilled CVEs being processed at once.