What is the Linux CNA?

Linux is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 10,294 CVE records since 2024.

How many CVEs has Linux published?

Linux has published 10,294 CVE records, including 10,294 in the last two years.

What is Linux's CVE data quality grade?

RadicalNotion.AI grades Linux's CVE data quality as F, with an overall completeness score of 54.1%. This reflects how consistently its CVE records include vendor (100%), product (100%), CVSS (0%), and CWE (16.5%) information.

What products does Linux publish CVEs for?

Linux most frequently publishes CVEs for Linux, Linux Kernel, Kernel, debian linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP.

Which vendors does Linux cover?

Linux publishes CVEs across 2 distinct vendors, most often Linux, debian, Siemens, Red Hat, Intel Corporation.

Is Linux actively publishing CVEs?

Linux is currently active, based on 10,294 CVEs in the last two years.

How many critical CVEs has Linux published?

Linux has published 149 critical-severity CVEs and 3,194 high-severity CVEs.

Are any of Linux's CVEs in CISA's Known Exploited Vulnerabilities catalog?

Yes. 7 of Linux's CVEs are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning they are confirmed to be exploited in the wild.

What are the most common weakness types in Linux's CVEs?

Linux's CVEs most often map to these CWE weakness types: CWE-476 (NULL Pointer Dereference), CWE-416 (Use After Free), CWE-401 (Missing Release of Memory after Effective Lifetime), CWE-667 (Improper Locking).

How does Linux rank among CNAs?

By total CVE volume, Linux ranks #7 of 370 CNAs, and it reports more complete CVE records than 9% of all CNAs.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Grade F

Active

Linux

Name: Linux CNA CVE data quality report card
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE Numbering Authority

Latest CVE published February 4, 2026

10,294

CVEs published

Total assigned

2

Years active

2024–2026

N/A

Avg CVSS

Across scored CVEs

10,294

Recent CVEs

Last 2 years

Overview

Linux is a CVE Numbering Authority that has published 10,294 CVE records since 2024. It is currently classified as active, with 10,294 CVEs published in the last two years. Its CVE data quality is graded F (54.1% overall completeness).

Among the 370 CNAs tracked here, Linux ranks #7 by CVE volume and reports more complete records than 9% of all CNAs.

Data quality report card

How complete and consistent Linux's CVE records are, scored across vendor, product, CVSS, and CWE coverage.

A CVE record only requires a description to be published. “Completeness” measures how often Linux also fills in the optional — but extremely useful — fields that make a vulnerability actually actionable: the affected vendor and product, a CVSS severity score, and a CWE weakness type. A higher score means more of this CNA’s CVEs include those details, so defenders spend less time enriching records by hand.

Report card grade

F

54.1%

Overall score

Overall completeness54.1%

Vendor completeness100%

Product completeness100%

CVSS completeness0%

CWE completeness16.5%

86%

Update rate

Records revised after publishing

2

Vendor diversity

Distinct vendors covered

1,230 chars

Avg description length

Per CVE record

2024-02-20

First CVE date

Earliest assignment

2026-02-04

Latest CVE date

Most recent assignment

N/A

Average CVSS

Across scored CVEs

What these scores mean

Vendor completeness: The share of this CNA's CVEs that name an affected vendor.
Product completeness: The share that name a specific affected product.
CVSS completeness: The share that include a CVSS severity score.
CWE completeness: The share mapped to a CWE weakness type.
Update rate: How often this CNA revises CVE records after first publishing them.
Vendor diversity: How many distinct vendors this CNA publishes CVEs for.

Severity and exploitation

How the CVSS severity of Linux's published CVEs breaks down, and how many are known to be exploited in the wild.

Critical149

High3,194

Medium7,747

Low120

1,358 additional CVEs have no CVSS severity score.

In CISA’s Known Exploited Vulnerabilities catalog

7

7 of Linux's CVEs are confirmed exploited in the wild and carry a CISA remediation deadline.

Common weakness types

The CWE weakness categories Linux most often assigns to its CVEs. Follow any weakness to its full explanation.

Publishing activity by year

How many CVEs Linux has published each year.

2024

4,289

2025

5,675

2026

2,604

Top vendors

The vendors Linux publishes the most CVEs for.

Linux12,568 CVEs
debian975 CVEs
Siemens929 CVEs
Red Hat101 CVEs
Intel Corporation24 CVEs
fedoraproject24 CVEs
AMD8 CVEs
netapp7 CVEs

Top products

The products Linux publishes the most CVEs for.

Linux12,568 CVEs
Linux Kernel11,234 CVEs
Kernel3,865 CVEs
debian linux975 CVEs
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP458 CVEs
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP458 CVEs
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP458 CVEs
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem408 CVEs

Latest CVEs

The most recent CVEs assigned by Linux.

CVE-2026-53366
ipv4: account for fraggap on the paged allocation path
High · CVSS 7.8
EPSS 0.2%2026-07-16
CVE-2026-53365
vsock/virtio: fix zerocopy completion for multi-skb sends
Unscored
EPSS 0.2%2026-07-13
CVE-2026-53364
Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
Unscored
EPSS 0.2%2026-07-13
CVE-2026-53363
xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
Critical · CVSS 9.8
EPSS 0.3%2026-07-10
CVE-2026-53362
ipv6: account for fraggap on the paged allocation path
High · CVSS 7.8
EPSS 0.1%2026-07-04
CVE-2026-53361
af_unix: Set gc_in_progress to true in unix_gc().
High · CVSS 7.1
EPSS 0.1%2026-07-04
CVE-2026-53360
KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
High · CVSS 8.8
EPSS 0.2%2026-07-04
CVE-2026-53359
KVM: x86: Fix shadow paging use-after-free due to unexpected role
High · CVSS 8.8
EPSS 0.1%2026-07-04
CVE-2026-53358
Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
High · CVSS 8.8
EPSS 0.2%2026-07-02
CVE-2026-53357
Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
High · CVSS 8.0
EPSS 0.2%2026-07-02
CVE-2026-53356
drm/i915/gem: Fix phys BO pread/pwrite with offset
High · CVSS 7.8
EPSS 0.1%2026-07-01
CVE-2026-53355
net: rds: clear i_sends on setup unwind
Critical · CVSS 9.8
EPSS 0.4%2026-07-01

Track new Linux CVEs as they are published and get AI-written analysis and remediation guidance.

Monitor Linux CVEs

Other CNAs

Compare data quality across other CVE Numbering Authorities.

mitreGrade F · 112,208 CVEs PatchstackGrade A · 14,729 CVEs VulDBGrade A · 12,140 CVEs microsoftGrade F · 11,701 CVEs redhatGrade F · 10,745 CVEs GitHub_MGrade A · 10,605 CVEs WordfenceGrade A · 8,652 CVEs oracleGrade F · 8,309 CVEs

Browse all CNAs

Frequently asked questions

Common questions about the Linux CNA.

What is the Linux CNA?: Linux is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 10,294 CVE records since 2024.
How many CVEs has Linux published?: Linux has published 10,294 CVE records, including 10,294 in the last two years.
What is Linux's CVE data quality grade?: RadicalNotion.AI grades Linux's CVE data quality as F, with an overall completeness score of 54.1%. This reflects how consistently its CVE records include vendor (100%), product (100%), CVSS (0%), and CWE (16.5%) information.
What products does Linux publish CVEs for?: Linux most frequently publishes CVEs for Linux, Linux Kernel, Kernel, debian linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP.
Which vendors does Linux cover?: Linux publishes CVEs across 2 distinct vendors, most often Linux, debian, Siemens, Red Hat, Intel Corporation.
Is Linux actively publishing CVEs?: Linux is currently active, based on 10,294 CVEs in the last two years.
How many critical CVEs has Linux published?: Linux has published 149 critical-severity CVEs and 3,194 high-severity CVEs.
Are any of Linux's CVEs in CISA's Known Exploited Vulnerabilities catalog?: Yes. 7 of Linux's CVEs are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning they are confirmed to be exploited in the wild.
What are the most common weakness types in Linux's CVEs?: Linux's CVEs most often map to these CWE weakness types: CWE-476 (NULL Pointer Dereference), CWE-416 (Use After Free), CWE-401 (Missing Release of Memory after Effective Lifetime), CWE-667 (Improper Locking).
How does Linux rank among CNAs?: By total CVE volume, Linux ranks #7 of 370 CNAs, and it reports more complete CVE records than 9% of all CNAs.

References

CNA report-card grades are computed by RadicalNotion.AI from published CVE records. CVE data is sourced from the CVE Program.

Track Linux CVEs

Monitor new vulnerabilities as this CNA publishes them, with AI-written analysis and remediation guidance.

Start free See pricing