BSP Tracker / Kernel CVEs
What the kernel published, and whether the fix reached you
The Linux kernel CNA publishes CVEs at a rate that swings by two orders of magnitude from one week to the next, and a fix landing upstream is not the same event as a fix landing in the tree your product builds from. This page tracks both halves.
Reading this page
The kernel project assigns no CVSS scores, by policy. Severity in the kernel is a function of what you build and where the device sits, and a single number cannot carry that. Where a score appears in a kernel record it is the CNA’s own secondary metric, not NVD’s. NVD analysis for a large batch can trail publication by weeks. Prioritise by reachability, not by a number.
Weekly volume is not a quality signal. The 8 windows on record run from 49 to 878. A spike is usually the CNA catching up — a backlog of older assignments published in one batch, or a full stable cycle landing at once — not a week when the kernel got worse. Each row says which.
A commit date proves a branch is alive, not that a fix is in it. The second table measures the gap between the newest upstream release in a series and the last commit on the vendor branch that pins it. A branch that moved yesterday may still not carry this cycle’s backports — the date narrows where to look, it does not close the question. Read the branch log before you ship.
The per-CVE detail lives in the weekly advisory, linked from each row. This page carries what stays true between them.
Kernel CVE publication, by week
November 20261 week · 71 CVEs
| Window | CVEs published | Rejected | Scored in record | What moved the number |
|---|---|---|---|---|
| 1 – 7 Nov 2026 | 71 | 10 | 13 of 71 | A low-volume week after 129 the week before: 71 records, 61 live and 10 rejected, and lore.kernel.org shows the same 71 announcements. 13 live records carry a CNA score and all 13 are HIGH (7.0 to 8.1); none is CRITICAL. The 6 November stable round raised every branch target, and the three Xen backend records CVE-2026-100080 to CVE-2026-100082 set the table value on 5.10, 5.15, 6.1, 6.6, 6.12 and 6.18, so last week's versions are no longer enough. Every branch target equals the current kernel.org release, so the patch table is a confirmed ceiling. 7.2 is end of life at 7.2.15, and the five ksmbd session records CVE-2026-99276 to CVE-2026-99280 list no 7.2 fix. No record states that a bug is being exploited. Full advisory → |
Earlier months are kept below, collapsed. The totals and the bar scale on this page still span every week on record, so a bar means the same thing in any month.
October 20264 weeks · 1,054 CVEs · range 49–656
| Window | CVEs published | Rejected | Scored in record | What moved the number |
|---|---|---|---|---|
| 25 – 31 Oct 2026 | 129 | 0 | 0 of 129 | 129 contiguous IDs, CVE-2026-99088 to CVE-2026-99216, none rejected, after 656 the week before. lore.kernel.org shows the same 129 announcements. No record carries a CNA score, so nothing is rated CRITICAL or HIGH and the score cannot rank the week. Records were published on 26 Oct (12) and 28 Oct (117). Counted on 31 October before the window closed, so the figure may be low. On 5.10, 5.15, 6.1, 6.6 and 6.12 the patch table equalled the newest release; on 6.18 and 7.2 it was one patch level below. Full advisory → |
| 18 – 24 Oct 2026 | 656 | 1 | 0 of 656 | A high-volume week after 49 the week before: 656 records, 655 live and 1 rejected (CVE-2026-98654), from CVE-2026-98433 to CVE-2026-99087 plus the out-of-sequence CVE-2023-7356. None carries a CNA score, so nothing is rated CRITICAL or HIGH and the score cannot rank the week. The 21 October stable round raised the target on 6.6, 6.12, 6.18 and 7.2 to 6.6.160, 6.12.114, 6.18.58 and 7.2.12, which equal the kernel.org releases. On 5.10, 5.15 and 6.1 the records name one patch level less than the newest release, so the patch table is not a ceiling there. 21 records, CVE-2026-98976 to CVE-2026-98996, fix mount and namespace races. The count is single-sourced to NVD; lore.kernel.org was not checked. Exploitation status was not assessed. Full advisory → |
| 11 – 17 Oct 2026 | 49 | 0 | 1 of 49 | A low-volume week after 220 the week before: 48 contiguous IDs, CVE-2026-98385 to CVE-2026-98432, plus CVE-2026-99999. None rejected, and lore.kernel.org shows the same 49 announcements as NVD. 1 record is CRITICAL (score 9.3, local vector): CVE-2026-99999, an IPv4 checksum_start check that the record calls defense in depth, with a more complete fix still to come. The 15 October stable round raised every branch target, and CVE-2026-99999 and the TCP use-after-free CVE-2026-98432 set the table value on each branch, so last week's versions are no longer enough. Every branch target equals the current kernel.org release, so the patch table is a confirmed ceiling. 9 records name a stable fix only for 7.2. No record states that a bug is being exploited. Full advisory → |
| 4 – 10 Oct 2026 | 220 | 0 | 52 of 220 | 220 contiguous IDs, CVE-2026-98165 to CVE-2026-98384, none rejected, against 1 record the week before. 2 are CRITICAL and both sit in the software RDMA drivers, siw (CVE-2026-98323) and rxe (CVE-2026-98365), so they matter only where those drivers are loaded and configured. CVE-2026-98365 lists no fix for 5.10, 5.15 and 6.1. Every branch target equals the current kernel.org release, so the patch table is a confirmed ceiling. CVE-2026-98375 is fixed only in 7.3-rc7, which is not released yet. No record states that a bug is being exploited. Full advisory → |
September 20263 weeks · 1,928 CVEs · range 443–878
| Window | CVEs published | Rejected | Scored in record | What moved the number |
|---|---|---|---|---|
| 20 – 26 Sep 2026 | 607 | 0 | 129 of 607 | A lighter week for severity: 4 CRITICAL records against 35 and 54 in the two weeks before. All four sit in network storage server code — the NFS server RPC layer (SUNRPC GSS and NFS over RDMA), the RTRS server and the SRP target — so they matter only on hosts that run those servers. Every record was published on 24 to 26 Sep, in eight separate ID blocks from CVE-2026-93205 to CVE-2026-100079. Every branch target equals the current kernel.org release, so the patch table is a confirmed ceiling. Many records list no fix yet on 5.10 to 6.6, including CRITICAL CVE-2026-93228 and CVE-2026-97413, so the branch bump there does not clear every record. The count of 607 matches on both NVD and lore.kernel.org. Full advisory → |
| 13 – 19 Sep 2026 | 878 | 2 | 319 of 878 | Roughly double the previous week by volume, but with fewer CRITICAL records: 35 against 54. The IDs are not one continuous run — they arrive in four blocks, CVE-2026-89774 to 90435, 92476 to 92525, 93037 to 93086 and 93089 to 93204 — so computing IDs across the range produces CVEs that do not exist. The 35 CRITICAL records are spread across NVMe over Fabrics, ksmbd, NFS server and client, Ceph, IPsec, KVM on arm64 and x86, NTFS3, ISO9660, iSER and qla2xxx rather than clustered in one area as last week. Every branch target equals the current kernel.org release for that branch, so the patch table is a confirmed ceiling. 7.1 reached end of life at 7.1.13 and takes no fixes from this set. Count is single-sourced to NVD; lore.kernel.org was unreachable behind Anubis. Full advisory → |
| 6 – 12 Sep 2026 | 443 | — | 174 of 443 | The largest ordinary week of the year so far, and by a wide margin the most severe. Unlike the 1,086 below this is genuine weekly output, not a backlog: two ID blocks, CVE-2026-80914 to CVE-2026-81018 and CVE-2026-89436 to CVE-2026-89773. 54 records carry a CRITICAL score from the CNA. Almost all of them sit in network filesystem and RPC code — NFSD, ceph, SMB client and ksmbd, SUNRPC and ntfs3 — and most are reachable over the network without credentials. It reads as a coordinated audit of that code rather than an ordinary week. Several records name a fix only on 7.2 and mainline, so the branch bump does not clear every one. Full advisory → |
Range across all 8 weeks on record: 49 to 878. The bar is a log scale. On a linear one an ordinary week next to a backlog flush is an invisible sliver, which would misrepresent both.
The fix shipped upstream. Has it reached your vendor tree?
Every maintained longterm series took a patch release on 6 November 2026. Each row below is one of the 17 SoCs on the BSP status table, showing the gap between that release and the last commit on the vendor branch it pins. 8 of 17 have not moved since that cycle.
- No stream or frozen
- No upstream longterm behind it, or no commit in over a year.
- Lagging or stalled
- Alive, but has missed the most recent stable cycles.
- Tracking
- Moved within a fortnight of the last stable cycle. Still verify the log.
| SoC | Vendor branch | Series | Newest upstream | Branch last moved | Behind by |
|---|---|---|---|---|---|
No upstream fix stream1The branch pins a kernel series that was never longterm. There is no upstream stable release to be behind, and no security backports are coming from kernel.org at all. | |||||
| NVIDIA Jetson Orin (Tegra234) NVIDIA | Jetson Linux 39.2.1 (JetPack 7.2.1) | 6.8 | none — not a longterm series | 11 August 2026 | No upstream fix stream |
Frozen — over a year1The branch has taken no commit in more than a year. Whatever the last stable cycle fixed, this tree has not carried it. | |||||
| Amlogic A311D (G12B) Amlogic | khadas-linux-6.12.y | 6.12 | 6.12.116 6 November 2026 | 5 August 2025 | 458 days |
Stalled — 4 to 12 months2The branch is alive but has missed several stable cycles. Assume the recent CVE fixes are not in it until you check the log yourself. | |||||
| ST STM32MP1 (STM32MP157) STMicroelectronics | v6.6-stm32mp | 6.6 | 6.6.162 6 November 2026 | 1 June 2026 | 158 days |
| ST STM32MP2 (STM32MP257) STMicroelectronics | v6.6-stm32mp | 6.6 | 6.6.162 6 November 2026 | 1 June 2026 | 158 days |
Lagging — 2 weeks to 4 months4The branch is alive but has not moved since the last full stable cycle. The most recent round of fixes has not landed on it yet. | |||||
| NXP i.MX6ULL NXP | lf-6.18.y | 6.18 | 6.18.62 6 November 2026 | 8 September 2026 | 59 days |
| NXP i.MX8M Plus NXP | lf-6.18.y | 6.18 | 6.18.62 6 November 2026 | 8 September 2026 | 59 days |
| NXP i.MX93 NXP | lf-6.18.y | 6.18 | 6.18.62 6 November 2026 | 8 September 2026 | 59 days |
| Rockchip RK3588 / RK3588S Rockchip | develop-6.1 | 6.1 | 6.1.192 6 November 2026 | 29 July 2026 | 100 days |
Tracking — within a fortnight8The branch moved within a fortnight of the last stable cycle. That is the best signal a commit date can give, and it is still not proof the fixes were merged. | |||||
| TI AM335x (Sitara) Texas Instruments | ti-linux-6.18.y | 6.18 | 6.18.62 6 November 2026 | 5 November 2026 | 1 day |
| TI AM62A (AM62A7) Texas Instruments | ti-linux-6.18.y | 6.18 | 6.18.62 6 November 2026 | 5 November 2026 | 1 day |
| TI AM62x (AM625) Texas Instruments | ti-linux-6.18.y | 6.18 | 6.18.62 6 November 2026 | 5 November 2026 | 1 day |
| TI J721E / TDA4VM Texas Instruments | ti-linux-6.18.y | 6.18 | 6.18.62 6 November 2026 | 5 November 2026 | 1 day |
| Qualcomm QCS6490 (RB3 Gen 2) Qualcomm | qcom-6.18.y | 6.18 | 6.18.62 6 November 2026 | 6 November 2026 | 0 days |
| Renesas RZ/G2L (R9A07G044) Renesas | rz-6.12-cip15 | 6.12 | 6.12.116 6 November 2026 | 30 October 2026 | 7 days |
| Microchip SAMA7G5 (SAMA7G54) Microchip | linux-6.18-mchp | 6.18 | 6.18.62 6 November 2026 | 6 November 2026 | 0 days |
| AMD Zynq UltraScale+ MPSoC AMD (Xilinx) | xlnx_rebase_v6.18_LTS | 6.18 | 6.18.62 6 November 2026 | 4 November 2026 | 2 days |
No public tree1The vendor publishes no browsable git for this SoC, so there is nothing to date. Recorded as unknown rather than guessed. | |||||
| Allwinner T507 / T527 Allwinner | Tina 5.0_AIOT | 5.15 | 5.15.225 6 November 2026 | no public tree | No public tree |
The weekly advisory
Every week we read the CNA announcements, cross-check the count against NVD, and write up what to patch by device class — with the minimum safe release for each branch. That is where the individual CVEs are discussed. This page carries the shape of the problem; the advisory carries the week.
Get the updates
An email when a kernel series reaches end of life, a board row changes, or a layer picks up a release branch. Nothing else.
RSS