In the Linux kernel, the following vulnerability has been resolved: dm raid: fix accesses beyond end of raid member array On dm-raid table load (using raid_ctr), dm-raid allocates an array. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
In the Linux kernel, the following vulnerability has been resolved: media: i2c: max9286: fix kernel oops when removing module When removing the max9286 module we get a kernel oops: Unable to handle. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. This Exposure of Resource to Wrong Sphere vulnerability could allow attackers to access resources from an unintended security context.
Use-after-free in the Linux kernel TPM subsystem allows a local attacker to trigger kernel memory corruption by exploiting a reference counting defect in struct tpm_chip. The flaw manifests when a file descriptor to /dev/tpmrm is held open while the underlying TPM driver module (e.g., tpm_tis_spi) is unloaded, then a write is issued to that descriptor - causing tpm_common_write() to attempt a kobject_get() on an already-zeroed reference counter. No public exploit has been identified at time of analysis, and EPSS at 0.10% signals low opportunistic exploitation pressure.
Use-after-free in the Linux kernel's ref_tracker subsystem exposes local low-privilege users to full kernel memory corruption during netdevice teardown. The flaw exists because ref_tracker_alloc() and ref_tracker_free() do not validate the dead status of a struct ref_tracker_dir after ref_tracker_dir_init() marks it as destroyed, allowing dev_put()/dev_hold() operations that fire too late in the netdevice dismantle sequence to access logically-freed memory. No public exploit exists and EPSS at 0.05% (14th percentile) confirms negligible real-world exploitation activity; active exploitation is not confirmed in CISA KEV.