A privilege escalation vulnerability exists in the integration between Active Directory and the System Security Services Daemon (SSSD) on Linux systems, where an attacker with permissions to modify AD attributes can impersonate privileged users by exploiting a fallback mechanism in the Kerberos authentication plugin. The vulnerability affects domain-joined Linux hosts running SSSD in default configurations and allows attackers to gain unauthorized access with high privileges. With a low EPSS score of 0.05% and no KEV listing, this appears to be a theoretical risk requiring existing AD permissions rather than an actively exploited vulnerability.
Denial of wireless scanning in the Linux kernel's mac80211 subsystem occurs on Sub-1GHz (S1G / 802.11ah) hardware because the S1G capability element is not counted in scan_ies_len, causing a buffer-length validation failure in ieee80211_prep_hw_scan() and a triggered WARN in __ieee80211_start_scan(). Affected builds are Linux 6.17 release candidates (rc1-rc4); the result is that hardware scanning stops functioning on S1G-capable adapters. There is no public exploit identified at time of analysis, EPSS is very low (0.14%), and the upstream fix is available via kernel.org stable commits.
Local privilege escalation and kernel memory disclosure in the Linux kernel's GPIO ACPI subsystem (gpiolib) affects development builds 6.17-rc1 through 6.17-rc6, where an uninitialized acpi_gpio_info structure is passed to __acpi_find_gpio() and its stale info->quirks field is later consumed in acpi_populate_gpio_lookup(). The regression, introduced by commit 7c010d463372, breaks the i2c_hid_acpi driver (probe fails with -EINVAL / 'has not been provided an Int IRQ') and causes the kernel to act on uninitialized stack memory. No public exploit identified at time of analysis, and EPSS is low at 0.14% (4th percentile), consistent with a hard-to-weaponize local memory-safety regression confined to release candidates.
Local privilege-boundary corruption in the Linux kernel's io_uring zero-copy notification path (io_link_skb) affects the 6.17 release-candidate series (rc1 through rc6). A copy-paste style bug assigned prev_notif from the current 'nd' instead of 'prev_nd', so the context-validation check compares a notification against itself and never enforces the intended same-context constraint, allowing a local low-privileged user to link skb notifications across mismatched io_uring contexts with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile).
Kernel-level memory corruption in the Linux kernel's rxrpc/RxGK subsystem allows an out-of-bounds access when the rxgk_yfs_decode_ticket() function parses an authentication response packet. The flaw stems from an unchecked unsigned subtraction ('ticket_len - 10 * 4') on attacker-influenced length data, which can underflow and drive an out-of-bounds write (CWE-787). It affects Linux 6.17 release-candidate kernels (rc1 through rc6); there is no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.13% (3rd percentile).
A local privilege-boundary/state-handling flaw in the Linux kernel's TCP stack lets an unprivileged user leave a stale TCP Fast Open request socket (fastopen_rsk) attached to a socket after tcp_disconnect(), which the retransmit timer later dereferences. By abusing accept() → connect(AF_UNSPEC) → connect() on a server-side TFO socket before the 3-way handshake completes, an attacker drives the socket into TCP_ESTABLISHED while retaining fastopen_rsk, triggering a kernel WARNING in tcp_retransmit_timer() and a failed retransmission. There is no public exploit identified at time of analysis, and the issue is not in CISA KEV; it was found by syzbot and resolved upstream by calling reqsk_fastopen_remove() in tcp_disconnect().