Linux kernel vulnerabilities on end-of-life distributions
The kernel is the most exploited open-source component in the CISA catalogue of known exploited vulnerabilities. Old distributions run old kernel series. These are the series they ship, with the vulnerabilities the US National Vulnerability Database lists for them. 30 of the exploited ones affect at least one of these series.
Request a server assessmentLinux kernel versions in end-of-life distributions
| Linux kernel | Ships with | Known CVEs | Critical | Exploited | Forkward |
|---|---|---|---|---|---|
| 2.6.32 | CentOS 6 | 3,883 | 90 | 15 | Patch on order, 48 h |
| 3.10 | CentOS 7, RHEL 7 and Oracle Linux 7 | 4,401 | 127 | 14 | Patch on order, 48 h |
| 4.4 | Ubuntu 16.04 | 4,672 | 153 | 13 | Patch on order, 48 h |
| 4.14 | Amazon Linux 2 | 5,167 | 175 | 17 | Patch on order, 48 h |
| 4.15 | Ubuntu 18.04 | 5,219 | 175 | 16 | Patch on order, 48 h |
| 4.18 | CentOS 8 | 5,399 | 189 | 16 | Patch on order, 48 h |
| 4.19 | Debian 10 | 5,540 | 193 | 16 | Patch on order, 48 h |
| 5.4 | Ubuntu 20.04 | 5,948 | 207 | 16 | Patch on order, 48 h |
| 5.10 | Debian 11 | 6,752 | 244 | 20 | Patch on order, 48 h |
Vulnerabilities from the US National Vulnerability Database, 28 October 2026, for the upstream version, counting only entries where Linux kernel itself is the vulnerable product. Exploited: listed in the CISA catalogue of known exploited vulnerabilities. Package versions from each distribution's public repositories. Distribution builds include some vendor fixes; your assessment shows which risks are real.
End-of-life Linux
The distributions behind these versions, what else they still run, and when their support ended. End-of-life Linux
Patch on order, 48 h
We backport the fix to the version you run within 48 hours of your order, or within 24 hours with priority delivery. See the plans