Blog

Notes from the KernelScan team

Announcements, deep dives, and the occasional war story from building Linux kernel CVE intelligence.

  1. 7 min read

    19 Public Root Exploits in Two Days. Seven Have No Fix on a Longterm Kernel.

    On October 22 and 23, Google published 19 kernelCTF root exploits. 17 need unprivileged user namespaces; 7 have no fix in any 5.10, 5.15 or 6.1 release.

    Read more exploit-maturityreachabilitylongterm kernelslinux-kernel
  2. 6 min read

    Two Leaked ksmbd RCE Bugs, No CVE Yet: Is Your Linux Product Exposed?

    ZDI's ksmbd reports leaked to LKML before any fix shipped. Which kernels have the bugs, the Kconfig gate, where the fixes sit, and a 30-second check.

    Read more Linux kernelksmbdReachabilityProduct security
  3. 9 min read

    Kernel CVE Batch Analysis: October 18, 2026 (436 CVEs, 10 remote Criticals)

    436 Linux kernel CVEs landed on October 18, 2026, none scored by NVD. All 10 Criticals are remote; most sit behind a tunnel, protocol or driver. A product triage.

    Read more CVE triageLinux kernelProduct security
  4. 5 min read

    Before the CVE: Pre-CVE Candidates Are Now in KernelScan Basic

    Almost every Linux kernel CVE passes through a public review queue days before it is published. How the kernel CNA decides, why that queue is unreadable for non-developers, and how KernelScan's pre-CVE candidates, now on every paid plan from Basic up, turn it into an early warning.

    Read more AnnouncementsLinux kernelKernel CNAPre-CVEProduct security
  5. 4 min read

    Attack-Path Triage: Which Kernel CVEs Can Actually Reach Your Device

    Configuration analysis tells you whether a kernel CVE is in your build. Attack-path triage tells you whether anyone can reach it. Three CVEs from our example managed switch, with the public VEX to check them.

    Read more Linux kernelCVE triageVEXCRAProduct security
  6. 9 min read

    Config-Based Kernel CVE Triage Is Accepted Practice. Now for CIP Kernels, Too

    At OSS + ELC Europe in Prague on Wednesday, two back-to-back talks (Siemens for CIP, and GESYS) triaged kernel CVEs by what the build contains, the method KernelScan is built on. Plus what's new: CIP SLTS kernels analysed with CIP's own fix data.

    Read more Linux kernelCIPCVE triageCRAProduct security
  7. 15 min read

    Kernel CVE Batch Analysis: October 6-7, 2026 (210 CVEs, 39 in Wi-Fi)

    210 Linux kernel CVEs landed on October 6-7, 2026. The Criticals hit data-center code; 39 hit Wi-Fi, which every embedded product carries. A product triage.

    Read more CVE triageLinux kernelProduct security
  8. 7 min read

    Every Linux Kernel CVE, Assessed

    19,691 of 20,096 Linux kernel CVEs now carry a plain-language assessment. Three questions every CVE now answers: is the code in my kernel, who can reach the bug, and does that attacker exist on my device.

    Read more Linux kernelCVE triageVEXProduct security
  9. 10 min read

    Kernel CVE Batch Analysis: September 24-25, 2026 (606 CVEs, 36 of them remote)

    606 Linux kernel CVEs landed on September 24-25, 2026 - 7 Critical, 36 network-reachable Highs, and a new twist: the server is often the attacker.

    Read more CVE triageLinux kernelProduct security
  10. 13 min read

    Kernel CVE Batch Analysis: September 16-17, 2026 (878 CVEs, 62 of them remote)

    878 Linux kernel CVEs landed on September 16-17, 2026 - 37 Critical, but only 62 of the 376 high-rated entries are network-reachable. A product triage.

    Read more CVE triageLinux kernelProduct security
  11. 5 min read

    Four Public Root Exploits Dropped Today. We Had the CVEs Since August.

    On September 18, working local-root exploits went public for four Linux kernel CVEs. KernelScan had ingested every one of those CVEs on its publication day — and NVD still hasn't scored one of them.

    Read more exploit-maturityreachabilityVEXlinux-kernel
  12. 11 min read

    Kernel CVE Batch Analysis: September 11, 2026 (431 CVEs, a file-server batch) — v2 review copy

    431 Linux kernel CVEs landed on September 11, 2026 — 71 Critical, 53 of them in the NFS, Ceph, SMB and OCFS2 file-server stack. A product-triage walkthrough.

    Read more CVE triageLinux kernelProduct security
  13. 11 min read

    Kernel CVE Batch Analysis: September 11, 2026 (431 CVEs, a file-server batch)

    431 Linux kernel CVEs landed on September 11, 2026 — 71 Critical, 53 of them in the NFS, Ceph, SMB and OCFS2 file-server stack. A product-triage walkthrough.

    Read more CVE triageLinux kernelProduct security
  14. 7 min read

    BadGarbage (CVE-2026-53361): why product security needs real-time exploit and PoC intelligence

    Two public exploits, wrong published version ranges, vendor trackers weeks behind. CVE-2026-53361 as a worked case for why product security needs a real-time source of the latest exploits and PoCs.

    Read more Linux kernelExploit maturityCVE triageReachability
  15. 7 min read

    Exploit Maturity Is Live: Public Kernel PoCs Now Surface in KernelScan

    KernelScan now distinguishes public PoCs, weaponized exploits and CISA KEV—and carries both urgency signals into owner-facing CycloneDX VEX exports.

    Read more Linux kernelCVE triageExploit maturityCISA KEV
  16. 12 min read

    Kernel CVE Batch Analysis: August 15, 2026 (848 CVEs, 338 awaiting NVD scores)

    848 Linux kernel CVEs landed on August 15. We sort all of them by severity, subsystem, and attacker reachability to expose the product-relevant queue.

    Read more CVE triageLinux kernelProduct security
  17. 11 min read

    Kernel CVE Batch Analysis: August 10, 2026 (346 CVEs, none scored by NVD)

    A product-focused triage of 346 Linux kernel CVEs published in a single day on August 10, 2026 — every one still unscored by NVD.

    Read more CVE triageLinux kernelProduct security
  18. 8 min read

    RefluXFS (CVE-2026-64600): am I actually vulnerable?

    A nine-year-old XFS reflink race just became local root on default RHEL. How to decide whether your product is actually affected — from the config symbol, through the USB-stick reflex, to the timeline your scanner won’t show you for two weeks.

    Read more Linux kernelXFSVEXReachability
  19. 14 min read

    Kernel CVE Batch Analysis: July 19, 2026 (431 CVEs, none scored by NVD)

    A product-focused triage of 431 Linux kernel CVEs published in a single day on July 19, 2026 — none scored by NVD — with a hard look at the ~72 local privilege-escalation bugs, including the keyring, statmount and block-layer ones you can't compile out.

    Read more CVE triageLinux kernelProduct security
  20. 8 min read

    Your Scanner Isn’t Wrong. Neither Is NVD. So Why Does It Flag Kernel CVEs You Don’t Have?

    We counted: on a fully-patched LTS kernel, up to 46% of scanner-reported kernel CVEs don’t apply to it. Nobody made a mistake — the cause is structural, and verifiable from public data.

    Read more SBOMCPELinux kernelCVE triageVEX
  21. 8 min read

    CVSS Said 9.8. Your Kernel Config Said “Not Affected.”

    Why NVD, Red Hat and a config-based analysis give three different answers for the same June 2026 kernel CVEs — and which one is about your system.

    Read more CVE triageLinux kernelCVSSProduct security
  22. 8 min read

    Hidden in 219 unscored kernel CVEs: CVE-2026-52943, an 8.4 local root that may not be present in your kernel at all

    Buried in 219 kernel CVEs with no NVD scores: a reliable local root in code every kernel ships — yet whether it can touch you comes down to one question the score never answers: is the gating config option, and the module that reaches it, even present in the kernel you run?

    Read more CVE heads-upPrivilege escalationLinux kernel
  23. 11 min read

    Kernel CVE Batch Analysis: June 24, 2026 (219 CVEs, none scored by NVD)

    A product-focused triage of 219 Linux kernel CVEs published in a single day on June 24, 2026 — every one still unscored by NVD.

    Read more CVE triageLinux kernelProduct security
  24. 10 min read

    Kernel CVE Batch Analysis: June 6-9, 2026 (62 CVEs)

    A product-focused triage of 62 Linux kernel CVEs published June 6-9, 2026 while NVD scoring is still pending.

    Read more CVE triageLinux kernelProduct security
  25. 2 min read

    KernelScan is open — request your invitation code

    KernelScan is live in invite-only early access. Here's what we built, why we're ramping up gradually, and how to get your invitation code.

    Read more Announcements