Seven Linux distributions share one package data format

Released April 30, 2026

Seven Linux distributions now describe affected packages in one format, the one the v4 Linux audit matches against. CVE records from six more CNAs get CPE configurations built from the CNA’s own data.

One format for Linux package data

Affected packages for Debian, Ubuntu, Fedora, Mageia, Amazon Linux, Alpine and Arch Linux are stored in one format. Each record names the package, the distribution (and its release, where there is one) and the affected version range. Arch Linux records carry no release, since Arch is a rolling distribution. For Debian and Ubuntu the data sits on the CVE records from each distribution’s security tracker, and for Ubuntu it includes only packages whose vulnerability is confirmed.

CPE data from six more CNAs

CVE records published by ICS-CERT, Juniper, NVIDIA, SAP, TWCERT and TR-CERT get CPE configurations built from the CNA’s own affected-product data, so the affected products are described in machine-readable form even before NVD has analyzed the CVE.