# Canonical list of kernel CVEs for the suggest-impact eval suite.
# One CVE per line. Lines starting with # are comments. Blank lines are ignored.
# Inline comments (after the CVE ID) are allowed.
#
# After editing this file, regenerate the CSV and populate all caches:
#   make prepare-kernel-eval

# -- Important (OSIDB) --
CVE-2025-38590
CVE-2024-53104  # also in XgBoost training set
CVE-2023-53186
CVE-2026-23074
CVE-2025-68305
CVE-2022-50865
CVE-2025-38352
CVE-2025-40248
CVE-2025-38089  # also in XgBoost training set
CVE-2025-38052
CVE-2022-50873
CVE-2023-54258

# -- Moderate (OSIDB) --
CVE-2025-39718
CVE-2025-39905
CVE-2023-53669
CVE-2025-39682
CVE-2025-38718
CVE-2026-23097
CVE-2026-23003
CVE-2026-22998
CVE-2026-23011
CVE-2025-37803
CVE-2023-54311
CVE-2022-50851
CVE-2023-54045
CVE-2023-54213
CVE-2023-54081
CVE-2022-50768

# -- Low (OSIDB) --
CVE-2026-23032
CVE-2025-71182
CVE-2023-54247
CVE-2022-50836
CVE-2023-54181
CVE-2023-54209
CVE-2025-68742
CVE-2023-54222

# -- Kernel-panic overestimation benchmark (AEGIS-441) --
# Moderate CVEs with kpanic features — should NOT escalate to Important.
# Used to detect and tune kernel_panic severity overestimation.
CVE-2023-53510  # Moderate, kpanic SCSI UFS local crash — should not escalate
CVE-2025-40320  # Moderate, kpanic+UAF SMB cfid — local path, R11 over-escalation risk
CVE-2025-39754  # Moderate, kpanic mm/smaps race — local DoS only
CVE-2023-53764  # Moderate, kpanic wifi ath12k lock — adjacent-network, G3 risk
CVE-2025-37798  # Moderate, kpanic codel qdisc — networking subsystem, G3 risk
CVE-2025-39677  # Moderate, kpanic net/sched qdisc — privileged-only, should stay Moderate
CVE-2025-39810  # Moderate, kpanic bnxt_en corruption — network driver, G3 risk
CVE-2025-39809  # Moderate, kpanic+UAF HID intel-thc — contained HW path, R11 risk
