Datasetpublic

pebblebed/kernel-vuln-dataset

Linux Kernel Vulnerability Dataset 125,183 bug-introducing commits mined from 20 years of Linux kernel git history (2005-2025). Dataset Description This dataset maps every kernel bug fix with a Fixes: tag back to the commit that introduced the bug. It enables research on: Vulnerability detection: Train models to identify bug-introducing commits Bug lifetime analysis: Study how long different bug types persist Subsystem risk assessment: Identify which kernel… See the full description on the dataset page: https://huggingface.co/datasets/pebblebed/kernel-vuln-dataset.

sourceHugging Facemitupdated 9mo agoView on Hugging Face

1likes252downloads

Dataset Card

Linux Kernel Vulnerability Dataset

125,183 bug-introducing commits mined from 20 years of Linux kernel git history (2005-2025).

Dataset Description

This dataset maps every kernel bug fix with a Fixes: tag back to the commit that introduced the bug. It enables research on:

—Vulnerability detection: Train models to identify bug-introducing commits
—Bug lifetime analysis: Study how long different bug types persist
—Subsystem risk assessment: Identify which kernel subsystems have the longest-lived bugs
—Developer patterns: Analyze who introduces and fixes bugs

Key Statistics

Metric	Value
Total bug-fix pairs	125,183
Valid records (0 < lifetime < 27 years)	123,696
Average bug lifetime	2.1 years
Median bug lifetime	0.7 years
Longest-lived bug	20.7 years
Bugs hiding 5+ years	13.5%
Unique fixing commits	119,449
Unique bug-introducing authors	9,159
With CVE ID	158
With Cc: stable	27,875 (22%)

Dataset Structure

Data Fields

Column	Type	Description
`fixing_commit`	string	SHA of the commit that fixed the bug
`introducing_commit`	string	SHA of the commit that introduced the bug
`lifetime_days`	int	Days between introduction and fix
`subsystem`	string	Kernel subsystem (networking, drivers, fs, etc.)
`bug_type`	string	Detected bug type (race-condition, null-deref, etc.)
`fix_subject`	string	Commit message subject of the fix
`fixing_date`	datetime	When the fix was committed
`introducing_date`	datetime	When the bug was introduced
`files_changed`	string	Files modified in introducing commit
`insertions`	int	Lines added in introducing commit
`deletions`	int	Lines removed in introducing commit
`cve_id`	string	CVE ID if mentioned in fix commit (nullable)
`cc_stable`	bool	Whether fix was tagged for stable backport
`fix_author`	string	Author of the fix
`intro_author`	string	Author who introduced the bug

Subsystem Distribution

Subsystem	Count	Avg Lifetime
drivers	38,412	2.3 years
networking	6,079	2.9 years
gpu	5,212	1.4 years
filesystem	4,891	2.6 years
sound	3,847	2.1 years
usb	2,505	3.5 years
memory	2,459	1.8 years
bpf	959	1.1 years

Bug Type Distribution

Bug Type	Count	Avg Lifetime
null-deref	4,931	2.2 years
use-after-free	2,963	3.2 years
memory-leak	2,846	3.1 years
refcount	2,209	2.8 years
deadlock	1,683	2.2 years
race-condition	1,188	5.1 years
buffer-overflow	399	3.1 years
integer-overflow	298	3.9 years

Collection Methodology

Mining Process

1.Clone Linux kernel repository at v6.19-rc3
2.Run git log --grep="Fixes:" to find all fixing commits
3.Extract the referenced commit hash from each Fixes: tag using regex
4.Retrieve metadata (dates, authors, files) from both commits
5.Classify subsystem from file paths using 70+ regex patterns
6.Detect bug type from commit message keywords
7.Calculate lifetime as fixing_date - introducing_date

Extraction Code

python

import re

def extract_fixes_tag(commit_msg: str) -> str | None:
    """Extract the commit ID from a Fixes: tag"""
    pattern = r'Fixes:\s*([a-f0-9]{12,40})'
    match = re.search(pattern, commit_msg, re.IGNORECASE)
    return match.group(1) if match else None

Filtering

—Excluded commits where Fixes: tag points to non-existent hash
—Excluded merge commits
—For lifetime analysis: excluded same-day fixes (lifetime_days = 0)
—For lifetime analysis: excluded outliers (lifetime > 10,000 days)

Limitations

—Selection bias: Only ~28% of fix commits use Fixes: tags. Well-documented bugs (likely more serious) are overrepresented.
—Mainline only: Doesn't include bugs fixed only in stable branches or vendor kernels.
—Subsystem classification: Heuristic-based on file paths; some bugs span multiple subsystems.
—Bug type detection: Keyword-based; many bugs classified as "unknown".
—Timestamp accuracy: Uses author dates, not commit dates. Rebasing can skew.

Intended Uses

Out of Scope

—Direct exploit development (commits don't include full code context)
—Claiming completeness of kernel vulnerability data

Citation

bibtex

@dataset{qu2026kernelvuln,
  author = {Qu, Jenny Guanni},
  title = {Linux Kernel Vulnerability Dataset},
  year = {2026},
  publisher = {HuggingFace},
  url = {https://huggingface.co/datasets/quguanni/kernel-vuln-dataset}
}

License

MIT License

Contact

—Author: Jenny Guanni Qu
—Email: jenny@pebblebed.com
—Blog post: Kernel bugs hide for 2 years on average