514 Linux Kernel CVEs in June 2026
Full month · Source: NIST NVD
In June 2026, 514 Linux kernel CVEs were published, sourced from the NIST National Vulnerability Database. Of these, 40 were rated Critical, 238 were rated High severity and 236 Medium. CVE-2026-53266 was confirmed as actively exploited in the wild and added to the CISA Known Exploited Vulnerabilities catalog. June's 514 CVEs represent 6% of all 2026 Linux kernel CVEs , down from May's 1,034 (a 50% month-over-month decrease) .
Actively Exploited CVEs — June 2026
1 CVE in CISA KEVCVE-2026-53266 is the only Linux kernel CVE from June 2026 confirmed as actively exploited in the wild. It carries a CVSS score of 8.8 (High severity) and is listed in the CISA Known Exploited Vulnerabilities catalog.
| CVE ID | Severity | CVSS | Published | Description | |
|---|---|---|---|---|---|
| CVE-2026-53266 | High KEV | 8.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_sna… |
| CVE ID | Package | Severity | CVSS | Published | Description | |
|---|---|---|---|---|---|---|
| CVE-2026-53309 | linux | Critical | 9.8 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: fix off-by-one in dlm_match_regions() re… | |
| CVE-2026-53175 | linux | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir… | |
| CVE-2026-53247 | linux | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in m… | |
| CVE-2026-53215 | linux | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use… | |
| CVE-2026-53216 | linux | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer m… | |
| CVE-2026-53260 | linux | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk… | |
| CVE-2026-53246 | linux | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COO… | |
| CVE-2026-53228 | linux | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offlo… | |
| CVE-2026-53221 | linux | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_… | |
| CVE-2026-53151 | linux | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table… | |
| CVE-2026-53176 | linux | Critical | 9.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADE… | |
| CVE-2026-53055 | linux | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec2 - prevent req used-after-fre… | |
| CVE-2026-52931 | linux | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender va… | |
| CVE-2026-52989 | linux | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() er… | |
| CVE-2026-52924 | linux | Critical | 9.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling … |