8,106 Linux Kernel CVEs in 2026 (Year to Date)
Year to date · Updated daily from NIST NVD
In 2026, 8,106 Linux kernel CVEs have been published so far, sourced daily from the NIST National Vulnerability Database. Of these, 537 are rated Critical and 2,902 High severity , with 3 confirmed as actively exploited via the CISA KEV catalog . At the current pace, 2026 is on track to exceed 2025's 5,681 CVEs — with an estimated 9,928 CVEs projected for the full year. A further 3,018 CVEs are still awaiting NVD severity scoring. This page updates daily as new CVEs are published.
Monthly CVE Breakdown — 2026
CVEs published per month with severity breakdown
September (2,118) was the most active month in 2026. Together the top months account for a significant share of 2026's 8,106 total CVEs. March (178) had the lowest volume.
Severity Distribution — 2026
Breakdown across 8,106 CVEs
20% Medium · 36% High · 7% Critical. 3,018 CVEs (37%) still awaiting NVD scoring.
Monthly Counts — 2026
CVE counts by month and severity
September was the most active month with 2,118 CVEs — 26% of 2026's total. March (178) had the lowest volume.
| Month | Total | Critical | High | Medium | Low | Share of year |
|---|---|---|---|---|---|---|
| January | 246 | 4 | 64 | 115 | 2 |
3%
|
| February | 220 | 1 | 45 | 139 | 0 |
3%
|
| March | 178 | 1 | 61 | 116 | 0 |
2%
|
| April | 379 | 27 | 159 | 193 | 0 |
5%
|
| May | 1,034 | 42 | 398 | 592 | 1 |
13%
|
| June | 514 | 40 | 238 | 236 | 0 |
6%
|
| July | 838 | 88 | 410 | 212 | 0 |
10%
|
| August | 1,651 | 212 | 742 | 1 | 0 |
20%
|
| September | 2,118 | 111 | 640 | 42 | 0 |
26%
|
| October | 928 | 11 | 145 | 0 | 0 |
11%
|
| Total | 8,106 | 537 | 2,902 | 1,646 | 3 |
Actively exploited CVEs — 2026
3 CVEs confirmed in CISA KEV catalog
All CVEs — 2026
8106 CVEs
| CVE ID | Package | Severity | CVSS | Published | Description | |
|---|---|---|---|---|---|---|
| CVE-2026-98924 | linux | Awaiting NVD | — | 2026-10-23 | In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evict_inodes() We obser… | |
| CVE-2026-98919 | linux | Awaiting NVD | — | 2026-10-23 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: harden adjust_idledly() against divide-by-z… | |
| CVE-2026-98910 | linux | Awaiting NVD | — | 2026-10-23 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copy_to_use… | |
| CVE-2026-98922 | linux | Awaiting NVD | — | 2026-10-23 | In the Linux kernel, the following vulnerability has been resolved: net: emac: move setting of netops to fix crash fixe… | |
| CVE-2026-98916 | linux | Awaiting NVD | — | 2026-10-23 | In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: check link is beaconing for color ch… | |
| CVE-2026-98918 | linux | Awaiting NVD | — | 2026-10-23 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: use a page-aligned address in … | |
| CVE-2026-98885 | linux | Awaiting NVD | — | 2026-10-23 | In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be cha… | |
| CVE-2026-98894 | linux | Awaiting NVD | — | 2026-10-23 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/ras: reset CPER ring on corrupt entry size … | |
| CVE-2026-98902 | linux | Awaiting NVD | — | 2026-10-23 | In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bm_seq comparison wrap-s… | |
| CVE-2026-98926 | linux | Awaiting NVD | — | 2026-10-23 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS [Why] … |
2026 Linux Kernel CVE Highlights
-
Large backlog awaiting NVD scoring
3,018 of 2026's CVEs (37%) are still listed as "Awaiting NVD" — meaning no CVSS score has been assigned yet. This is typical for bulk-published CVEs from the Linux kernel CNA: the kernel team publishes CVEs rapidly, and NVD scoring lags by weeks or months.
-
Monthly variation
CVE publication in 2026 was uneven across months. September was the most active with 2,118 CVEs. March (178) had the lowest volume. Monthly spikes typically correspond to coordinated batches of backfilled CVEs being processed at once.