Linux Kernel Security Intelligence
Know your kernel's
real exposure
Upload a .config and get a CycloneDX VEX report — filtered by kernel version, build configuration, and AI‑powered context analysis. Updated in real time as new CVEs appear.
Model your product once — deployment context, interfaces, hardening — and receive a daily digest of the newly published CVEs that actually affect it, already triaged. No re-scanning, no backlog.
Free tier · no credit card · no invitation needed
Free CVE Database
Browse and search all kernel CVEs instantly — including AI-assessed scores where NVD is still pending. Sign up free to run your first VEX analysis.
Version & Config-Aware VEX
Filter by kernel version and .config — get a CycloneDX VEX of precisely your build's exposure. Analyses update automatically when new CVEs land.
AI-Powered Context Analysis
Model your product's deployment context and interfaces. AI rules out CVEs that don't apply to your device.
See It In Action
Explore real analysis results — no account required.
Kernel .config VEX
The same kernel .config analysed with version and config filtering only. Pure config analysis — every CVE matching an enabled subsystem is reported, without deployment context.
Product Security Assessment
The same config with deployment context, interfaces, and hardening modelled. AI contextual analysis rules out CVEs that don't apply to this device.
High severity, AI-triaged
Latest Linux kernel disclosures
-
CVSS8.8AI
bluetooth IsoBase OverflowCVE-2023-7356
A buffer overflow in the Bluetooth ISO subsystem allows an attacker in radio range to corrupt kernel memory by sending a crafted LE Periodic Advertising report. The vulnerability r…
-
CVSS7.0AI
bpf Verifier Zext BypassCVE-2026-98869
A logic error in the BPF verifier's zero-extension tracking for 32-bit operations on s390 allows a malicious BPF program to leave the upper 32 bits of a 64-bit register uninitializ…
-
CVSS9.8AI
net/ipv6 ChecksumSetup UnderflowCVE-2026-98573
Any device with IPv6 enabled is vulnerable to remote kernel memory corruption by receiving a crafted IPv6 packet with extension headers. The bug allows an unauthenticated network a…
-
CVSS9.8AI
ipv6 ExtensionHeader OOBCVE-2026-98532
A remote attacker can send a crafted IPv6 packet with extension headers that declare lengths exceeding the actual packet size. This causes the IPv6 stack to compute an offset past…
-
CVSS9.8AI
ipv6 DstDevOverhead OverflowCVE-2026-98570
A remote attacker can trigger a kernel heap buffer overflow by sending IPv6 traffic through a vulnerable system configured with seg6, ioam6, or rpl lwtunnels and a VLAN interface u…
-
CVSS9.8AI
mlx5e IPsecMask SwapCVE-2026-98497
A logic error in the Mellanox mlx5e driver's IPv6 IPsec hardware offload causes source and destination policy masks to be swapped when programming flow rules. This allows network a…
-
CVSS9.8AI
sctp StaleCookie UAFCVE-2026-98548
Any device with SCTP enabled and exposed to a network (Internet or LAN) is at risk. A remote attacker can send a crafted SCTP packet bundle containing a Stale Cookie ERROR followed…
-
CVSS9.8AI
gue Remcsum UnderflowCVE-2026-98621
Systems with GUE (Generic UDP Encapsulation) tunnels enabled are at risk from remote attackers who can send crafted packets. A malicious GUE packet with reversed REMCSUM offsets tr…
-
CVSS9.8AI
iscsi DataIn CorruptionCVE-2026-98479
A malicious iSCSI target can send a Data-In PDU referencing a WRITE command's ITT, causing the initiator to overwrite its own write buffer with attacker-controlled data. This corru…
Linux Kernel CVE Database
Freely searchable. Sourced from NVD and kernel.org's CVE v5 git feed, AI-enriched within minutes of publication.
| CVE ID | Severity | CVSS | Description | Introduced | Published |
|---|
Plans & Pricing
From free CVE intelligence to full AI-powered security assessments.
Free
Basic
Pro
Enterprise
Price & features agreed with you · billed by invoice against a contract — no credit card
Enterprise is our custom tier — contact sales and we'll agree on price and features for your needs (unlimited products, any kernel version). Unlike Basic and Pro, Enterprise is billed by invoice against a written contract: you get a quote, we agree the terms, and you pay by bank transfer on an invoice carrying your purchase-order number — no credit card anywhere in the process. It's also the route for analyzing kernels on behalf of clients — security consultancies, auditors, managed-service providers — which is a separate field of use under our terms. Talk to sales.
| Feature | Free | Basic | Pro | Enterprise |
|---|---|---|---|---|
| VEX analyses / month | 2 | Unlimited | Unlimited | Unlimited |
| Persistent products | — | 3 | 10 | Unlimited |
| Kernel coverage | Current LTS | Current LTS | All active LTS + stable | Any version |
| CVE database search | ✓ | ✓ | ✓ | ✓ |
| Live CVE feed (AI + Dependency-Track) | Last 60 days | All CVEs | All CVEs | All CVEs |
| Pre-CVE candidates, before the CVE is published | — | ✓ | ✓ | ✓ |
| API access | Throttled | Throttled | Full speed | Full speed |
| CycloneDX VEX reports | ✓ | ✓ | ✓ | ✓ |
| AI contextual assessments | — | — | ✓ | Priority |
| Security factor analysis | — | — | ✓ | ✓ |
| Dashboard & email alerts | — | ✓ | ✓ | ✓ |
| Auto-push VEX to Dependency-Track | — | — | ✓ | ✓ |
| Team Support | — | — | — | ✓ |
| On Premise | — | — | — | ✓ |