DaystoPatch

VendorsPlatform

Linux kernel

The Linux kernel is the open-source operating system kernel maintained by the kernel.org community, which has been the CVE numbering authority for kernel bugs since 2024.

Response trend, 6 months
Not enough history
Open now
None
Latest incident
28 Jun 2026
Incidents on record
14

Response to exploited bugs

Not rated. 2 reviewed zero-days on record. A grade needs at least 3.

Fixing privately reported bugs

71 range 60–81rank 13 of 20

Provisional Wide range: 60–81.

What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work

Embed this report card

Why these grades

Every clock starts at the first public report.

  • Response to exploited bugs: not rated. 2 reviewed zero-days in the last 36 months. A grade needs at least 3.
  • First fix within a day for all 2 zero-days.
  • Every supported version fixed within a day for 1 of 2 zero-days. The other one took 4 days.
  • First advisory within a day for all 2 zero-days.
  • Fixing privately reported bugs: B- (70), provisional. Median 138 days from private report to ZDI's public advisory (56 cases). 29 of 56 took longer than ZDI's 120-day deadline. 54 of 56 concern Kernel.
  • 7 of 9 reviewed exploited bugs had a public fix before exploitation was reported. They do not count toward the response grade. For 2 of them, fixes for every version came later, up to 8 days.

Response to exploited bugs: sub-scores

  • Time to first advisory2 of 2 zero-days within a day
    78
    2 cases, low confidence, not used for this vendor
  • Time to first fix2 of 2 zero-days within a day
    78
    2 cases, low confidence, not used for this vendor
  • Time to fix all versions1 of 2 zero-days within a day, longest 4 days
    78
    2 cases, low confidence, not used for this vendor
  • OpennessAdvisories available by API and RSS. 2 of 2 fixed zero-days with a public fix date for every version.
    64
    6 cases, low confidence, not used for this vendor

Fixing privately reported bugs: sub-score

  • Private fix speedMedian 138 days from private report to ZDI's public advisory (56 cases)
    71B−
    56 cases, low confidence, weight 100%

Response fingerprint

Median of 2 graded zero-days. Vendor statement 0h, first fix 0h, all versions 43h.

Compressed time scale

Counts toward the response grade 2

  1. 27 Dec 2024Linux kernel ALSA usb-audio Extigy/Mbox out-of-bounds access used in Cellebrite's chain (CVE-2024-53197)
  2. 19 Nov 2024Linux kernel uvcvideo and HID bugs in Cellebrite's Android unlock chain (CVE-2024-53104, CVE-2024-50302)
Not graded 12: n-days, unreviewed timelines and end-of-life products
  1. 28 Jun 2026Linux kernel IPv6 fraggap heap overflow, 'ipv6_frag_escape' container escape (CVE-2026-53362)Not graded: n-day
  2. 25 Jun 2026Linux kernel netfilter ebtables SNAT ARP rewrite out-of-bounds write (CVE-2026-53266)Not graded: n-day
  3. 22 Apr 2026Linux kernel 'Copy Fail' AF_ALG authencesn page-cache write privilege escalation (CVE-2026-31431)Not graded: n-day
  4. 13 Oct 2025Linux kernel AF_ALG concurrent-write race in af_alg_sendmsg (CVE-2025-39964)Not graded: n-day
  5. 5 Sep 2025Linux kernel TLS zero-length record handling on rx_list (CVE-2025-39682)Not graded: n-day
  6. 22 Jul 2025Linux kernel posix-cpu-timers race (CVE-2025-38352), exploited on AndroidNot graded: n-day
  7. 24 Dec 2024Linux kernel ALSA usb-audio out-of-bounds read when finding clock sources (CVE-2024-53150)Not graded: n-day
  8. 22 Mar 2023Linux kernel OverlayFS setuid copy-up privilege escalation (CVE-2023-0386)Not graded: n-day
  9. 25 Mar 2022Linux kernel watch_queue out-of-bounds write (CVE-2022-0995)Not graded: n-day
  10. 3 Mar 2022Linux kernel cgroups v1 release_agent privilege escalation / container escape (CVE-2022-0492)Not graded: n-day
  11. 7 Jul 2021Linux kernel netfilter x_tables heap out-of-bounds write (CVE-2021-22555)Not graded: n-day
  12. 25 Sep 2018Linux kernel create_elf_tables() integer overflow, 'Mutagen Astronomy' (CVE-2018-14634)Not graded: n-day
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Open, no fix
  • Open, partly fixed
  • Fixed when disclosed
  • Date only, no time of day

One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.

Exploited incidents

14 in 24 months, 0 with known ransomware use, 14% exploited before a fix

First reportIncidentCVSSSilenceFirst fixAll fixedStatusGrade
28 Jun 2026Linux kernel IPv6 fraggap heap overflow, 'ipv6_frag_escape' container escape (CVE-2026-53362)CVE-2026-533627.85.6d5.6d5.6dFixedNot graded: n-day
25 Jun 2026Linux kernel netfilter ebtables SNAT ARP rewrite out-of-bounds write (CVE-2026-53266)CVE-2026-532668.80h0h0hFixedNot graded: n-day
22 Apr 2026Linux kernel 'Copy Fail' AF_ALG authencesn page-cache write privilege escalation (CVE-2026-31431)CVE-2026-314317.80h0h8dFixedNot graded: n-day
13 Oct 2025Linux kernel AF_ALG concurrent-write race in af_alg_sendmsg (CVE-2025-39964)CVE-2025-399647.80h0hnot datedFixedNot graded: n-day
5 Sep 2025Linux kernel TLS zero-length record handling on rx_list (CVE-2025-39682)CVE-2025-396829.80h0h0hFixedNot graded: n-day
22 Jul 2025Linux kernel posix-cpu-timers race (CVE-2025-38352), exploited on AndroidCVE-2025-383527.80h0h0hFixedNot graded: n-day
27 Dec 2024Linux kernel ALSA usb-audio Extigy/Mbox out-of-bounds access used in Cellebrite's chain (CVE-2024-53197)CVE-2024-531977.80h0h0hFixedCounts toward grade
24 Dec 2024Linux kernel ALSA usb-audio out-of-bounds read when finding clock sources (CVE-2024-53150)CVE-2024-531507.10h0h0hFixedNot graded: n-day
19 Nov 2024Linux kernel uvcvideo and HID bugs in Cellebrite's Android unlock chain (CVE-2024-53104, CVE-2024-50302)CVE-2024-53104, CVE-2024-503027.80h0h3.5dFixedCounts toward grade
22 Mar 2023Linux kernel OverlayFS setuid copy-up privilege escalation (CVE-2023-0386)CVE-2023-03867.8–same daysame dayFixedNot graded: n-day
25 Mar 2022Linux kernel watch_queue out-of-bounds write (CVE-2022-0995)CVE-2022-09957.8–0h0hFixedNot graded: n-day
3 Mar 2022Linux kernel cgroups v1 release_agent privilege escalation / container escape (CVE-2022-0492)CVE-2022-04927.8–same daysame dayFixedNot graded: n-day
Show 2 more incidents
First reportIncidentCVSSSilenceFirst fixAll fixedStatusGrade
7 Jul 2021Linux kernel netfilter x_tables heap out-of-bounds write (CVE-2021-22555)CVE-2021-225558.3–0h0hFixedNot graded: n-day
25 Sep 2018Linux kernel create_elf_tables() integer overflow, 'Mutagen Astronomy' (CVE-2018-14634)CVE-2018-146347.8–0h7.4dFixedNot graded: n-day

Private reports

Median 138 days, 52% over 120 days, 0 published unpatched

Bugs reported privately to Linux kernel by ZDI or Project Zero.

One tick per graded report. Counts to the vendor's fix when its date is known, else to publication. Taller ticks were published before a fix existed.
PublishedAdvisoryProductDays from report to fix or to publication. Tick: ZDI's 120-day deadline.Patch at publication
14 Sep 2026ZDI-26-623, ZDI-26-687CVE-2026-80994, CVE-2026-90111Kernel33to publicationYes
14 Sep 2026ZDI-26-688CVE-2026-74465Kernel55to publicationYes
14 Sep 2026ZDI-26-609, ZDI-26-686CVE-2026-74565Kernel62to publicationYes
14 Sep 2026ZDI-26-442, ZDI-26-568, ZDI-26-570, ZDI-26-573, ZDI-26-681CVE-2026-64265, CVE-2026-68431Kernel; Kernel KSMBD73to publicationYes
14 Sep 2026ZDI-26-575, ZDI-26-691CVE-2026-53182Kernel81to publicationYes
14 Sep 2026ZDI-26-684CVE-2026-64397Kernel KSMBD95to publicationYes
14 Sep 2026ZDI-26-572, ZDI-26-683, ZDI-26-689, ZDI-26-697, ZDI-26-698, ZDI-26-699, ZDI-26-701CVE-2026-46227, CVE-2026-64046, CVE-2026-72463Kernel96to publicationYes
14 Sep 2026ZDI-26-695CVE-2026-89688Kernel115to publicationYes
14 Sep 2026ZDI-26-696CVE-2026-72196Kernel130to publicationYes
14 Sep 2026ZDI-26-680CVE-2026-31719Kernel145to publicationYes
Show all 56 private reports
PublishedAdvisoryProductDays from report to fix or to publication. Tick: ZDI's 120-day deadline.Patch at publication
14 Sep 2026ZDI-26-692CVE-2026-31583Kernel150to publicationYes
14 Sep 2026ZDI-26-574, ZDI-26-693CVE-2026-46319Kernel168to publicationYes
14 Sep 2026ZDI-26-694CVE-2026-23413Kernel214to publicationYes
14 Sep 2026ZDI-26-682, ZDI-26-690CVE-2026-43040, CVE-2026-45930Kernel284to publicationYes
14 Sep 2026ZDI-26-685CVE-2025-38416Kernel454to publicationYes
14 Sep 2026ZDI-26-700CVE-2026-22999Kernel552to publicationYes
14 Sep 2026ZDI-26-702CVE-2025-22050Kernel1090to publicationYes
24 Aug 2026ZDI-26-443, ZDI-26-571, ZDI-26-576, ZDI-26-608CVE-2026-64530Kernel66to publicationYes
13 Aug 2026ZDI-26-569Kernel57to publicationYes
15 Apr 2026ZDI-26-289CVE-2025-71066Kernel148to publicationYes
31 Mar 2026ZDI-26-250CVE-2026-23092Kernel77to publicationYes
30 Mar 2026ZDI-26-238CVE-2023-6270Kernel913to publicationYes
16 Mar 2026ZDI-26-191, ZDI-26-193CVE-2022-1972, CVE-2022-32250Kernel1391to publicationYes
24 Sep 2025ZDI-25-915CVE-2025-39698Kernel34to publicationYes
24 Sep 2025ZDI-25-916CVE-2025-38561Kernel64to publicationYes
24 Sep 2025ZDI-25-917CVE-2025-38562Kernel68to publicationYes
28 Aug 2025ZDI-25-873CVE-2025-38563Kernel30to publicationYes
17 Jul 2025ZDI-25-610CVE-2025-38191Kernel35to publicationYes
29 May 2025ZDI-25-310CVE-2025-22037Kernel65to publicationYes
21 May 2025ZDI-25-307Kernel21to publicationYes
27 Feb 2025ZDI-24-1726, ZDI-25-100CVE-2024-50285Kernel87to publicationYes
12 Dec 2024ZDI-24-1688Kernel120to publicationYes
10 Dec 2024ZDI-24-1454, ZDI-24-1642, ZDI-24-1648CVE-2024-42070Kernel172to publicationYes
5 Nov 2024ZDI-24-1456Kernel33to publicationYes
5 Nov 2024ZDI-24-1455Kernel257to publicationYes
5 Sep 2024ZDI-24-1194CVE-2024-39463Kernel109to publicationYes
27 Aug 2024ZDI-24-1182Kernel46to publicationYes
22 Aug 2024ZDI-24-1161CVE-2024-36960Kernel120to publicationYes
29 Jul 2024ZDI-24-1018CVE-2024-35880Kernel118to publicationYes
29 Jul 2024ZDI-24-997CVE-2024-0565Kernel222to publicationYes
29 Jul 2024ZDI-24-996CVE-2023-52755Kernel269to publicationYes
29 Jul 2024ZDI-24-994, ZDI-24-995CVE-2023-39197, CVE-2023-39198Kernel437to publicationYes
21 Jun 2024ZDI-24-842CVE-2023-6200Kernel218to publicationYes
21 Jun 2024ZDI-24-843Kernel262to publicationYes
20 Jun 2024ZDI-24-821CVE-2024-36886Kernel56to publicationYes
14 Jun 2024ZDI-24-778Kernel290to publicationYes
14 Jun 2024ZDI-24-777Kernel297to publicationYes
10 Jun 2024ZDI-24-590CVE-2023-4458Kernel298to publicationYes
10 Jun 2024ZDI-24-587Kernel313to publicationYes
10 Jun 2024ZDI-24-227, ZDI-24-228, ZDI-24-586, ZDI-24-588, ZDI-24-589CVE-2023-39176, CVE-2023-39179, CVE-2023-39180, CVE-2023-52441, CVE-2023-52442Kernel328to publicationYes
10 Jun 2024ZDI-24-592, ZDI-24-593CVE-2023-31436, CVE-2023-39189Kernel635to publicationYes
10 Jun 2024ZDI-24-591CVE-2023-42755Kernel661to publicationYes
28 Mar 2024ZDI-24-297, ZDI-24-298, ZDI-24-299CVE-2023-52628Kernel205to publicationYes
1 Mar 2024ZDI-24-229CVE-2023-52440Kernel190to publicationYes
23 Feb 2024ZDI-24-194, ZDI-24-195CVE-2024-26592, CVE-2024-26594Kernel43to publicationYes
9 Jan 2024ZDI-24-020CVE-2023-6546Kernel278to publicationYes

Grade history

Response to exploited bugs: score at the end of each month.

Not rated at any point in this period.

Channels

Get Linux kernel's own alerts

What we watch

  • RSSkernel.org releases feed

See sources and health for when each was last read.