Skip to content

Linux · weakness class

Race Conditions

1,334 CVEs · 4 exploited

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

exploited in the wild
4
likely to be exploited
4

Every one of the 1,334 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature…CVE-2016-5195Linux · CVSS 7 · 84% likely

    CWE-362

  2. The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local user…CVE-2014-0196Linux · CVSS 5.5 · 20% likely

    CWE-362

  3. crypto: af_alg - Disallow concurrent writes in af_alg_sendmsgCVE-2025-39964Linux · CVSS 7.8 · 1.6% likelycovered by CyberSIXT

    CWE-3625 articles

  4. posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()CVE-2025-38352Linux · CVSS 7.8 · 1.4% likely

    CWE-367

  5. Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. Ho…CVE-2017-1000112Linux · 21% likely

    CWE-3621 bounty report

  6. In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.CVE-2019-6974Linux · 17% likely

    CWE-362

  7. Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the C…CVE-2016-8655Linux · 11% likely

    CWE-362

  8. A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via cr…CVE-2009-4272Linux · 11% likely

    CWE-667

  9. In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the…CVE-2018-12232Linux · 6.3% likely

    CWE-362

  10. An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a u…CVE-2018-20836Linux · 5.1% likely

    CWE-362

  11. Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain priv…CVE-2009-3547Linux · 4.9% likely

    CWE-362

  12. An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a race condition leading to a use-after-free, related to net namespace cle…CVE-2019-11815Linux · 4.4% likely

    CWE-362

  13. Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly…CVE-2014-2706Linux · 4.3% likely

    CWE-362

  14. The nlmclnt_mark_reclaim in clntlock.c in NFS lockd in Linux kernel before 2.6.16 allows remote attackers to cause a denial of service (process crash) and deny access to NFS expor…CVE-2006-5158Linux · 3.7% likely

    CWE-667

  15. In the Linux kernel 4.12, 3.10, 2.6 and possibly earlier versions a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service cond…CVE-2018-1000004Linux · 3.5% likely

    CWE-362

  16. Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c in the Linux kernel through 3.13.6 allows remote attackers to cause a denial of service (use-after-free…CVE-2014-0100Linux · 3.0% likely

    CWE-362

  17. Tree connection race condition remote code execution vulnerabilityCVE-2023-32254Linux · CVSS 9.8 · 2.9% likely

    CWE-362

  18. Race condition in the IP implementation in the Linux kernel before 3.0 might allow remote attackers to cause a denial of service (slab corruption and system crash) by sending pack…CVE-2012-3552Linux · 2.9% likely

    CWE-362

  19. The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdirty() in the touch_pmd() function inside the THP implementation. touch_pmd() can be reached by get_…CVE-2017-1000405Linux · 2.8% likely

    CWE-362

  20. Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (s…CVE-2014-2672Linux · 2.7% likely

    CWE-362

  21. In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This issue exists because…CVE-2018-18559Linux · 2.6% likely

    CWE-362

  22. Session race condition remote code execution vulnerabilityCVE-2023-32250Linux · CVSS 9 · 2.6% likely

    CWE-362

  23. Race condition in the sctp_icmp_proto_unreachable function in net/sctp/input.c in Linux kernel 2.6.11-rc2 through 2.6.33 allows remote attackers to cause a denial of service (pani…CVE-2010-4526Linux · 2.5% likely

    CWE-362

  24. Session race condition remote code execution vulnerabilityCVE-2023-32258Linux · CVSS 8.1 · 2.5% likely

    CWE-362

  25. Session race condition remote code execution vulnerabilityCVE-2023-32257Linux · CVSS 8.1 · 2.4% likely

    CWE-362

  26. The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use…CVE-2014-4699Linux · 2.3% likely

    CWE-362

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP

Updated AboutDevelopersSign in