LINUX STABLE · CVE DELIVERY
Linux CVE backports.
Follow each CVE across stable trees, from outstanding fix to accepted patch and released backport.
CVE INVENTORY
Across stable trees
One CVE per row, oldest first. Filters count distinct CVEs; a CVE can match different statuses across trees. Select a status for its evidence and review.
Size labels measure each upstream fix with context; exactly 100 lines is within the guideline. Not vulnerable includes absent bugs and equivalent fixes already present in the tree. Project credit is tracked separately from applicability and fix status.
What this table counts
The rows cover project deliveries, the complete applicable unfixed backlog, uncertain applicability, and recorded semantic reviews. Every row includes an assessment for each tracked stable tree, including fixes by other contributors.
All counts use distinct CVEs, including the summary, filters, and pagination. A CVE fixed in two trees counts once. Counts follow the selected tree and search; Project fixed and Project queued track project contributions, and Unfixed covers all applicable outstanding CVEs. Queued · all contributors includes every accepted fix; Project queued includes only project contributions.
Project fixed marks credited project fixes in green. Fixed elsewhere marks released or inherited fixes without recorded project attribution. A CVE can have a project fix in one tree and a fix elsewhere in another, so it can appear in both filters.
Not vulnerable follows a CNA version range or a recorded source assessment: the affected code is absent, the bug never existed, or equivalent fix logic is present. A moved implementation with the bug remains unfixed until a fix is queued or applied. Applied fixes take precedence over source assessments, which persist across stable releases. Cell details retain their original evidence. Small fixes still require an applicable, correct, tested backport.