Linux Kernel Security Intelligence
Know your kernel's
real exposure
Upload a .config and get a CycloneDX VEX report — filtered by kernel version, build configuration, and AI‑powered context analysis. Updated in real time as new CVEs appear.
Model your product once — deployment context, interfaces, hardening — and receive a daily digest of the newly published CVEs that actually affect it, already triaged. No re-scanning, no backlog.
Free tier · no credit card · no invitation needed
Free CVE Database
Browse and search all kernel CVEs instantly — including AI-assessed scores where NVD is still pending. Sign up free to run your first VEX analysis.
Version & Config-Aware VEX
Filter by kernel version and .config — get a CycloneDX VEX of precisely your build's exposure. Analyses update automatically when new CVEs land.
AI-Powered Context Analysis
Model your product's deployment context and interfaces. AI rules out CVEs that don't apply to your device.
See It In Action
Explore real analysis results — no account required.
Kernel .config VEX
The same kernel .config analysed with version and config filtering only. Pure config analysis — every CVE matching an enabled subsystem is reported, without deployment context.
Product Security Assessment
The same config with deployment context, interfaces, and hardening modelled. AI contextual analysis rules out CVEs that don't apply to this device.
High severity, AI-triaged
Latest Linux kernel disclosures
-
CVSS9.8AI
ksmbd StreamInfo OverflowCVE-2026-99273
A remote attacker who can connect to an exposed ksmbd (kernel SMB server) share can trigger a heap buffer overflow by requesting file stream information with a stream name length t…
-
CVSS9.1AI
smb SessionSetup OOBCVE-2026-99275
Any system that mounts SMB/CIFS shares is vulnerable to a malicious server stealing up to 64 KB of kernel memory per connection attempt. The flaw is triggered when the client proce…
-
CVSS8.1AI
ksmbd SessionProcfs UAFCVE-2026-99280
A remote attacker connecting to a ksmbd SMB server can trigger a use-after-free in the kernel by racing session cleanup against procfs reads of session information. Successful expl…
-
CVSS8.1AI
ksmbd SessionChannel UAFCVE-2026-99277
A use-after-free in the kernel SMB server (ksmbd) allows a remote unauthenticated attacker to corrupt kernel memory by racing session unregistration against connection cleanup. Suc…
-
CVSS8.0AI
smb ReadResponse OOBCVE-2026-99272
Systems that mount SMB2 shares or access SMB2 symlinks are vulnerable to a malicious server sending a crafted READ response with an invalid DataOffset/DataLength, causing the kerne…
-
CVSS7.9AI
line6 CaptureBuffer UAFCVE-2026-99271
A local user with access to a Line6 USB audio device can trigger a use-after-free read in the kernel by closing all capture streams and then starting playback via the impulse test…
-
CVSS7.8AI
sch_teql LowerQdisc UAFCVE-2026-99282
A local attacker with CAP_NET_ADMIN (obtainable in a user namespace) can trigger a use-after-free in the TEQL qdisc by configuring a VLAN slave over a dummy interface with a zero-l…
-
CVSS7.8AI
tun Ownerless BypassCVE-2026-99281
A local user can attach to and control persistent TUN/TAP network devices that have no owner or group assigned, bypassing the intended CAP_NET_ADMIN requirement. This allows interc…
-
CVSS7.5AI
ksmbd Session LeakCVE-2026-99279
A network attacker can exhaust kernel memory and connection slots on an SMB server by repeatedly establishing and logging off sessions. Each logoff leaves a session object in an ex…
Linux Kernel CVE Database
Freely searchable. Sourced from NVD and kernel.org's CVE v5 git feed, AI-enriched within minutes of publication.
| CVE ID | Severity | CVSS | Description | Introduced | Published |
|---|
Plans & Pricing
From free CVE intelligence to full AI-powered security assessments.
Free
Basic
Pro
Enterprise
Price & features agreed with you · billed by invoice against a contract — no credit card
Enterprise is our custom tier — contact sales and we'll agree on price and features for your needs (unlimited products, any kernel version). Unlike Basic and Pro, Enterprise is billed by invoice against a written contract: you get a quote, we agree the terms, and you pay by bank transfer on an invoice carrying your purchase-order number — no credit card anywhere in the process. It's also the route for analyzing kernels on behalf of clients — security consultancies, auditors, managed-service providers — which is a separate field of use under our terms. Talk to sales.
| Feature | Free | Basic | Pro | Enterprise |
|---|---|---|---|---|
| VEX analyses / month | 2 | Unlimited | Unlimited | Unlimited |
| Persistent products | — | 3 | 10 | Unlimited |
| Kernel coverage | Current LTS | Current LTS | All active LTS + stable | Any version |
| CVE database search | ✓ | ✓ | ✓ | ✓ |
| Live CVE feed (AI + Dependency-Track) | Last 60 days | All CVEs | All CVEs | All CVEs |
| Pre-CVE candidates, before the CVE is published | — | ✓ | ✓ | ✓ |
| API access | Throttled | Throttled | Full speed | Full speed |
| CycloneDX VEX reports | ✓ | ✓ | ✓ | ✓ |
| AI contextual assessments | — | — | ✓ | Priority |
| Security factor analysis | — | — | ✓ | ✓ |
| Dashboard & email alerts | — | ✓ | ✓ | ✓ |
| Auto-push VEX to Dependency-Track | — | — | ✓ | ✓ |
| Team Support | — | — | — | ✓ |
| On Premise | — | — | — | ✓ |