diff --git a/meta/classes/cve-check-kernel.bbclass b/meta/classes/cve-check-kernel.bbclass
new file mode 100644
index 0000000000..c01f0efd1d
--- /dev/null
+++ b/meta/classes/cve-check-kernel.bbclass
@@ -0,0 +1,132 @@
+#
+# Copyright OpenEmbedded Contributors
+#
+# SPDX-License-Identifier: MIT
+#
+# This class is used to check the CVEs against a specific kernel configuration.
+# Depends on data from the kernel.org CNA
+# https://git.kernel.org/pub/scm/linux/security/vulns.git
+# The CVE data provided by kernel.org includes the files that are
+# affected by a given CVE and are provided as json files
+#
+# It requires the kernel to be compiled to be able to extract which files are
+# used. It is created as optional check on top cve-check.
+#
+# To enable add in your local.conf
+# INHERIT += cve-check
+# INHERIT += cve-check-kernel
+#
+# Then execute
+# bitbake virtual/kernel -c cve_check_kernel
+#
+
+KERNEL_FILES_DIR ?= "${LOG_DIR}/cve/kernel_files"
+KERNEL_SRC_FILES ?= "${KERNEL_FILES_DIR}/compile_commands.json"
+KERNEL_CNA_REPO ?= "${DL_DIR}/CVE_CHECK/vulns"
+
+python () {
+    if not bb.data.inherits_class("cve-check", d):
+        raise bb.parse.SkipRecipe("Skip cve-check-kernel when cve-check class is not loaded.")
+
+    if d.getVar('PN', True) == d.getVar("PREFERRED_PROVIDER_virtual/kernel", True):
+        bb.build.addtask('do_save_compiled_files', None, 'do_compile_kernelmodules', d)
+        bb.build.addtask('do_cve_check_kernel', 'do_build', None, d)
+        d.appendVarFlag('do_cve_check_kernel', 'depends', 'virtual/kernel:do_cve_check ')
+        d.appendVarFlag('do_cve_check_kernel', 'depends', 'virtual/kernel:do_compile_kernelmodules ')
+        d.appendVarFlag('do_cve_check_kernel', 'depends', 'linux-vulns:do_unpack ')
+}
+
+do_save_compiled_files() {
+    bbplain "Fetching compiled files"
+    mkdir -p ${KERNEL_FILES_DIR}
+    ${S}/scripts/clang-tools/gen_compile_commands.py -o ${KERNEL_SRC_FILES}
+}
+
+def get_files_in_cve(d, cve):
+    import os
+    import glob
+    import json
+    datadir = d.getVar('KERNEL_CNA_REPO', True)
+    pattern = os.path.join(datadir, '**', f"{cve}.json")
+    cve_files = glob.glob(pattern, recursive=True)
+    files_affected = []
+    if len(cve_files) == 0:
+        return None
+    # Assuming one match
+    with open(cve_files[0]) as f:
+        k_cve = json.load(f)
+        for item in k_cve['containers']['cna']['affected']:
+            if item["defaultStatus"] == "affected":
+                if "programFiles" in item:
+                    files = item['programFiles']
+                    files_affected.extend(files)
+    if len(files_affected) == 0:
+        return None
+    return files_affected
+
+python do_cve_check_kernel() {
+    import json
+    bb.plain("Updating CVEs using compiled files")
+    kfiles = []
+    cves = {}
+    affected= []
+
+    with open(d.getVar('KERNEL_SRC_FILES', True), 'r') as file:
+        for item in json.load(file):
+            kfiles.append(item['file'].replace(f"{d.getVar('S')}/",""))
+    bb.debug(1, f"Total used kernel source files: {len(kfiles)}")
+
+    # We want to use the file in log directory
+    deploy_file = d.getVar("CVE_CHECK_RECIPE_FILE_JSON")
+    cvelogpath = d.getVar("CVE_CHECK_SUMMARY_DIR")
+    direct_file = d.getVar("CVE_CHECK_LOG_JSON")
+    fragment_file = os.path.basename(deploy_file)
+    fragment_path = os.path.join(cvelogpath, fragment_file)
+
+    with open(fragment_path, 'r') as file:
+        cves = json.load(file)
+
+    total = 0
+    for cve in cves['package'][0]['issue']:
+        status = cve['status']
+        id = cve['id']
+
+        if status == 'Unpatched':
+             is_affected = False
+             total += 1
+             affected_files = get_files_in_cve(d, id)
+             if affected_files is None:
+                  bb.debug(1, f"No file information for {id}")
+                  affected.append(id)
+                  is_affected = True
+                  continue
+             for f in affected_files:
+                 if f in kfiles:
+                     bb.debug(1, f"File match in {id}: {f}")
+                     affected.append(id)
+                     is_affected = True
+                     break
+             if not is_affected:
+                  bb.debug(1, f"Changing status. Files in {id} not compiled. {affected_files}")
+                  cve["status"] = "Ignored"
+                  cve["detail"] = "not-applicable-config"
+                  cve["description"] = f"Source code not compiled by config. {affected_files}"
+
+    # Update cve files generated from cve-check
+    write_string = json.dumps(cves, indent=2)
+    with open(direct_file, 'w') as f:
+        bb.note("Writing file %s with CVE information" % direct_file)
+        f.write(write_string)
+    if d.getVar("CVE_CHECK_COPY_FILES") == "1":
+        with open(deploy_file, "w") as f:
+            f.write(write_string)
+    if d.getVar("CVE_CHECK_CREATE_MANIFEST") == "1":
+        with open(fragment_path, "w") as f:
+            f.write(write_string)
+
+    # Summary
+    bb.warn(f"Before filter we have {total} CVEs")
+    bb.warn(f"After programFile filter we have {len(affected)}")
+    bb.warn(f"Affected CVEs after filtering: {affected}")
+}
+