linux kernel cves by fix author, 2026

top 20 of 1,587 authors, ranked by the number of 2026 linux kernel CVEs whose fix they wrote. data as of 2026-09-16.

the ranking (top 20)

that’s the top 20; the full ranking of all 1,587 authors is in the data files below.

the result

the linux kernel issues a CVE for nearly every bug fix that gets a stable tag, and each CVE points at the commit that fixed it. across the 5,405 2026 CVEs i could resolve to a fix author (1,587 distinct authors), i wrote the fixing commit for 106, first by 28.

how it’s counted

a CVE goes to the author of its mainline fix commit, read from the git author header. resolution is object-addressed with git cat-file, not git log --author, so backported fixes that never touched the local branch tip still count. one CVE, one author.

this counts who wrote the fix. a bug you reported but a maintainer patched credits the maintainer, so 106 is an authored-fix floor, not a ceiling. author and fix SHA are ground truth; the CVSS fields in the data are indicative only, since the kernel CNA assigns no CVSS. a severity-weighted view is unreliable on this corpus (46% coverage, floor-censored at 7.0), and i’ll cover that in a separate write-up rather than muddy the count here.

the data

• authors-2026.csv — the frequency table, all 1,587 rows, with the indicative severity mix.
• authors-2026.json — the same, plus each author’s CVE-id list.
• cves-2026.csv — per-CVE attribution: author, fix SHA, subject, and links to NVD and the kernel commit.
• leaderboard-2026.json — everything, plus a generated_utc timestamp and full provenance.

each build also writes MANIFEST-2026.json (byte size + sha256 per artifact) and a compact timestamped copy under snapshots/.

reproduce it

the generator is one self-contained python file, standard library plus git, no local paths baked in. clone the kernel CNA data and a kernel tree, then:

git clone https://git.kernel.org/pub/scm/linux/security/vulns.git
git clone --filter=blob:none https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

python3 build_leaderboard.py --year 2026 \
    --corpus vulns/cve/published --tree linux

it records which tree resolved each object and the tree HEADs it ran against, so a rerun on the same corpus reproduces the table exactly. the exact generator for this run is downloadable: build_leaderboard.py (MIT, standard library plus git).

see also

• glaurung windows driver findings — the same calibration discipline on windows kernel drivers.