5,260 Linux Kernel CVEs in 2026 (Year to Date)
Year to date · Updated daily from NIST NVD
In 2026, 5,260 Linux kernel CVEs have been published so far, sourced daily from the NIST National Vulnerability Database. Of these, 416 are rated Critical and 2,135 High severity , with 2 confirmed as actively exploited via the CISA KEV catalog . At the current pace, 2026 is on track to exceed 2025's 5,681 CVEs — with an estimated 7,589 CVEs projected for the full year. A further 1,121 CVEs are still awaiting NVD severity scoring. This page updates daily as new CVEs are published.
Monthly CVE Breakdown — 2026
CVEs published per month with severity breakdown
August (1,651) was the most active month in 2026. Together the top months account for a significant share of 2026's 5,260 total CVEs. March (178) had the lowest volume.
Severity Distribution — 2026
Breakdown across 5,260 CVEs
30% Medium · 41% High · 8% Critical. 1,121 CVEs (21%) still awaiting NVD scoring.
Monthly Counts — 2026
CVE counts by month and severity
August was the most active month with 1,651 CVEs — 31% of 2026's total. March (178) had the lowest volume.
| Month | Total | Critical | High | Medium | Low | Share of year |
|---|---|---|---|---|---|---|
| January | 246 | 4 | 64 | 115 | 2 |
5%
|
| February | 220 | 1 | 45 | 139 | 0 |
4%
|
| March | 178 | 1 | 61 | 116 | 0 |
3%
|
| April | 379 | 27 | 159 | 193 | 0 |
7%
|
| May | 1,034 | 42 | 398 | 592 | 1 |
20%
|
| June | 514 | 40 | 238 | 236 | 0 |
10%
|
| July | 838 | 88 | 408 | 193 | 0 |
16%
|
| August | 1,651 | 212 | 742 | 1 | 0 |
31%
|
| September | 200 | 1 | 20 | 0 | 0 |
4%
|
| Total | 5,260 | 416 | 2,135 | 1,585 | 3 |
Actively exploited CVEs — 2026
2 CVEs confirmed in CISA KEV catalog
All CVEs — 2026
5260 CVEs
| CVE ID | Package | Severity | CVSS | Published | Description | |
|---|---|---|---|---|---|---|
| CVE-2026-80916 | linux | Awaiting NVD | — | 2026-09-09 | In the Linux kernel, the following vulnerability has been resolved: kcov: fix data corruption and race conditions on PR… | |
| CVE-2026-80925 | linux | Awaiting NVD | — | 2026-09-09 | In the Linux kernel, the following vulnerability has been resolved: vlan: fix skb_under_panic and races when toggling H… | |
| CVE-2026-80920 | linux | Awaiting NVD | — | 2026-09-09 | In the Linux kernel, the following vulnerability has been resolved: io_uring: defer eventfd signaling when queued from … | |
| CVE-2026-80917 | linux | Awaiting NVD | — | 2026-09-09 | In the Linux kernel, the following vulnerability has been resolved: PCI: host-generic: Fix NULL pointer dereference on … | |
| CVE-2026-80915 | linux | Awaiting NVD | — | 2026-09-09 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix DPT allocation paths. Remove the fallba… | |
| CVE-2026-80919 | linux | Awaiting NVD | — | 2026-09-09 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix recursive ww_mutex acquire in amdgp… | |
| CVE-2026-80923 | linux | Awaiting NVD | — | 2026-09-09 | In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on tty_register_driver… | |
| CVE-2026-80922 | linux | Awaiting NVD | — | 2026-09-09 | In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - Allow zero as a random number Ze… | |
| CVE-2026-80918 | linux | Awaiting NVD | — | 2026-09-09 | In the Linux kernel, the following vulnerability has been resolved: HID: core: fix number/pointer type confusion on lon… | |
| CVE-2026-80893 | linux | Awaiting NVD | — | 2026-09-04 | In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix swap entry corruption when clearing… |
2026 Linux Kernel CVE Highlights
-
Large backlog awaiting NVD scoring
1,121 of 2026's CVEs (21%) are still listed as "Awaiting NVD" — meaning no CVSS score has been assigned yet. This is typical for bulk-published CVEs from the Linux kernel CNA: the kernel team publishes CVEs rapidly, and NVD scoring lags by weeks or months.
-
Monthly variation
CVE publication in 2026 was uneven across months. August was the most active with 1,651 CVEs. March (178) had the lowest volume. Monthly spikes typically correspond to coordinated batches of backfilled CVEs being processed at once.