5 min read Steffen Pfendtner

Before the CVE: Pre-CVE Candidates Are Now in KernelScan Basic

AnnouncementsLinux kernelKernel CNAPre-CVEProduct security

Suppose a serious bug in the Linux kernel's network stack has just been fixed. The fix is public in git, and the kernel's CVE team is discussing whether it deserves a CVE. Your product ships that kernel. Would you want to know now, or a week later, when it lands in your scanner together with 150 other CVEs?

review window, typically 1 to 7 daysFix mergedpublic in gitStable releasee.g. 7.2.9NominatedCNA reviewersCVE publishedcve.orgYour scannerfinds itthe fix is readable by anyone, attackers includedyou see it in KernelScanCVE-based tools
Who knows when. The fix is public first; CVE-based tools are the last to find out.

Starting today, KernelScan shows that early stage as pre-CVE candidates, on every paid plan from Basic up. Here is how it works.

How the kernel assigns CVEs

Since February 2024 the Linux kernel has been its own CVE Numbering Authority (CNA). Its rule is deliberately broad: any fix for a bug with possible security impact gets a CVE. That's around 150 a week. It also works from fixes, not reports, so the CVE always comes after the fix is public. The procedure runs in the open, in vulns.git:

REVIEW WINDOWResearcherMaintainersmainlineStable teamstable treesCNA reviewersGreg, Sasha, …vulns.gitpublic repoKernelScancve.org+ announce listprivate reportfix merged, publicCc: stablerelease 7.2.9review every fixproposed/ listsread the queueassess, issue IDagree on CVEspublish CVE + mailround → done/promote, carry over
The kernel CNA procedure. KernelScan reads the review queue while the CNA is still deciding.

The key step is the nomination. For every stable release, several reviewers each go through all of the fixes on their own and file their picks in cve/review/proposed/. The more reviewers pick a fix, the surer it is to become a CVE:

0 %25 %50 %75 %100 %1 reviewer40–80 %all nominations74–96 %3+ reviewers≈ 98 %
Nominated fixes that became a CVE, stable releases 7.1.6 to 7.2.6 (range across releases).

Public, but not readable

The queue is public, but it was written by kernel developers for kernel developers. One real fix from the 7.2.9 round:

WHAT THE CNA PUBLISHESv7.2.9-allen…b097d9d7a5b0 ("net/sched: act_ct:avoid modifying shared unconf…v7.2.9-ruiqi…f85009dfcd65 net/sched: act_ct:avoid modifying shared unconf…v7.2.9-sasha…f85009dfcd65 ("net/sched: act_ct:avoid modifying shared unconf…+ ~570 other lines for this releaseWHAT YOU SEE IN KERNELSCANKSCAN-PRE-CVE-0123act_ct SharedCt UAFCRITICAL 9.8provisionalRiskremote, no privilegesWeaknessuse-after-freeWheretraffic control, conntrackSinceLinux 6.2Fixed in7.2.9 (under review)Reviewers3 of 3 nominated itLikelihood95 % becomes a CVE
One real nomination from the 7.2.9 review round, before and after.

On the left, nothing tells you how severe the bug is, where it lives, since when, or whether it matters to you. On the right, you don't need to read a single patch.

What KernelScan does with the queue

for every open nomination in the queueCollectmap to mainline,count reviewersFilteralready a CVE?never released?Assessscore, weakness,risk in plain wordsReviewa second, separatecheckPublishscore ≥ 6.0 →KSCAN-PRE-CVE IDdroppedbelow 6.0:not listed

Open CVEs and switch to the Candidates tab. The list and the detail pages look like the CVE pages you already know, plus nomination date, reviewer votes and likelihood.

When the CVE arrives

Pre-CVE candidateKSCAN-PRE-CVE-NNNNprovisional scorePromotedthe CNA published a CVEassessment carries over, no re-analysisClosed without CVEthe CNA said nostays visible: our miss, on record227 PRE-CVE IDS SO FAR49 became CVEs178 still in review0 closed without CVE · as of 17 October 2026

A promoted candidate links to its CVE, and the CVE's timeline shows when the fix was nominated and how many days before publication.

What a pre-CVE is, and what it isn't

  • An early warning, not a verdict. Scores are KernelScan's own and marked "provisional". The kernel CNA's and NVD's scores appear next to ours once they exist.
  • Not a leak. Everything we read is public. What we add is the reading.
  • Not a certainty. Votes and likelihood are shown so you can weigh it. Three reviewers and a 9.8 is a different signal from one vote and a 6.1.

Available now, from Basic up. Pre-CVE candidates are part of every paid KernelScan plan: Basic, Pro and Enterprise. If you already have one of them, open CVEs and switch to the Candidates tab. If you're new, Basic starts with a 30-day trial: create an account or compare the plans.