Look up a kernel CVE
Paste a CVE id to jump straight to it, or search by subsystem to see what has been found there.
Debian right now
Where each Debian release stands across every Linux kernel CVE the security team tracks.
| Release | Kernel | Unfixed | Fix ready upstream | Unfixed & exploited | Typical time to an advisory |
|---|
Loading…
More filters
| Starred | CVE | Published | What it is | Signals | Debian releases |
|---|
How to read this
Every signal is a lookup in a published dataset keyed by CVE id, or arithmetic over published values. Nothing is inferred or model-scored, so the same inputs always give the same answer. Open any CVE and each signal carries a link to the file that published it, so you can go and check the number rather than take it from here.
Per-release lifecycle states
- vulnerable
- The Debian Security Team lists this release as unfixed, and upstream has published no fix for the stable series it tracks either. There is nothing to install yet.
- fix ready upstream
- Debian still lists it unfixed, but the stable series this release tracks already has a version containing the fix, so it should arrive in a future kernel update.
- fixed
- A fixed package version is available. Where a DSA or DLA shipped it, the advisory and date are shown.
- won't fix
- Debian triaged it and decided against an update for this release, with their stated reason.
- not affected
- This release never shipped the vulnerable code.
Does Debian build the code?
Debian publishes the full kernel configuration for every flavour it builds, so whether a release compiles the file the CVE is about is a lookup rather than a guess. One letter per release, from Debian's own configuration. A lower-case letter means every flavour of that release agrees; an upper-case letter means the flavours differ. Open any CVE for the switch name and the command that checks it locally.
Not established is not the same as not built. It means no build rule for the affected file was found, so nothing is known either way. Debian's own per-release status stays authoritative about the source package whatever these letters say.
Triage signals
- KEV
- Listed in CISA's Known Exploited Vulnerabilities catalogue, meaning there is evidence of exploitation in the wild. The strongest signal on this page.
- ransomware
- That KEV record carries
knownRansomwareCampaignUse: "Known". - EPSS
- FIRST's EPSS: modelled probability of exploitation in the next 30 days, republished daily.
- CVSS
- CVSS v3.1 base score, computed with the standard formula from the vector the Linux kernel CNA published. CVEs without a vector are shown as unrated rather than given an invented number.
- AV:N
- Attack vector. For kernel bugs, network-reachable versus local-only usually matters more than the score.
Follow along
Atom feeds of newly published CVEs that are still unfixed in a given release.