Use-after-free in the Linux kernel's octeontx2-pf network driver allows a local low-privileged user to trigger memory corruption via the otx2_tc_add_flow() traffic-control offload path, where new_node is dereferenced after being queued for freeing with kfree_rcu() outside a valid RCU read-side region. Successful exploitation can cause a denial of service (kernel crash) and, depending on heap state, potential local privilege escalation. There is no public exploit identified at time of analysis, and the low EPSS score (0.19%) reflects the narrow, hardware-specific attack surface.
Local privilege-escalation-class use-after-free in the Linux kernel's futex subsystem (requeue-PI path) lets a low-privileged local user race futex_wait_requeue_pi() against futex_requeue() so a kernel wakeup dereferences an on-stack futex_q structure that has already been freed and returned to userland. The flaw carries high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L). There is no public exploit identified at time of analysis, and EPSS is very low (0.05%, 15th percentile), consistent with a hard-to-weaponize timing race.
Guest-to-host memory corruption in the Linux kernel's Intel i40e Ethernet driver arises because the `ring_len` value supplied by an SR-IOV virtual function is written straight into the hardware memory context (HMC) with no bounds or alignment checking. A malicious or compromised VF owner (typically a guest VM given passthrough access to an Intel 700-series NIC) can specify out-of-range or misaligned Tx/Rx queue lengths, corrupting host-side descriptor context and impacting the host beyond the VF's boundary (CVSS 8.8, scope-changed). There is no public exploit identified at time of analysis and EPSS is low (0.20%, 10th percentile), consistent with a driver-level bug requiring a specific virtualization deployment.
Out-of-bounds array access in the Linux kernel's Intel i40e Ethernet driver allows a privileged virtual-function (VF) context to trigger memory corruption on the host by supplying an unvalidated traffic-class index. The flaw is in i40e_validate_queue_map(), where idx was not bounded against the number of active/initialized TCs before indexing vf->ch[idx] during SR-IOV channel/ADQ configuration. No public exploit identified at time of analysis; EPSS is low (0.20%) and it is not listed in CISA KEV, but the CVSS:3.1 score of 8.8 with scope change reflects the guest-to-host boundary crossing.
Privilege escalation and host memory corruption in the Linux kernel's i40e Intel Ethernet driver allows a malicious or buggy SR-IOV virtual function to send a crafted 'config queues' mailbox message with an out-of-range channel index, causing out-of-bounds access to the vf->ch[idx] array in i40e_vc_config_queues_msg(). Exploitation crosses the VF-to-host trust boundary (CVSS scope change) and can disclose or corrupt host kernel memory. The issue is fixed upstream across multiple stable trees; no public exploit and no CISA KEV listing exist, and EPSS is low (0.20%, 10th percentile), indicating no public exploit identified at time of analysis.
Out-of-bounds access in the Linux kernel's Intel i40e (40GbE) Ethernet driver arises from a flawed bounds check on the 'action_meta' value used during traffic-control/hardware-offload configuration, allowing a local user with network-configuration privileges to trigger an out-of-bounds dereference. The upstream fix corrects the comparison to 'greater or equal' so that indices at the array boundary are rejected. No public exploit identified at time of analysis, EPSS is low (0.20%), and the issue is not in CISA KEV; the assigned CVSS is 8.8 (Local, low complexity), reflecting high impact to a system carrying this Intel NIC and driver.
Improper VF-state validation in the Linux kernel's i40e (Intel Ethernet 700-series) driver lets a virtual function request PF resources it should not be able to obtain, because the resource-allocation check keyed on I40E_VF_STATE_ACTIVE rather than the narrower I40E_VF_STATE_RESOURCES_LOADED state. In SR-IOV deployments this can allow a low-privileged local actor controlling a VF to cross the VF/host trust boundary (CVSS scope-change), with claimed high confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not in CISA KEV.
A use-after-free write in the Linux kernel's Realtek rtw89 Wi-Fi driver lets kernel memory be corrupted when rtw89_core_tx_kick_off_and_wait() races with the TX-completion/status path (rtw89_pci_release_txwd_skb) and dereferences an skb_data buffer that was already freed back to skbuff_head_cache. The flaw was caught by KFENCE during Wi-Fi scan completion and is triggered by a timing race between the waiting and signaling sides of a completion object, affecting systems using Realtek rtw89-supported chipsets. There is no public exploit identified at time of analysis, it is not in CISA KEV, and the EPSS probability is low (0.19%, 9th percentile); the fix has been merged upstream.
Use-after-free in the Linux kernel Bluetooth stack (net/bluetooth/hci_sync.c) lets an in-range attacker corrupt kernel memory during HCI ACL/LE connection setup. When a connection object is still pending command submission (conn->state == BT_OPEN), a concurrent HCI Connection Complete event can free the hci_conn structure while hci_acl_create_conn_sync (and hci_le_create_conn_sync) still writes to it. CVSS is 8.8 over an adjacent (Bluetooth-range) vector; there is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile).
Use-after-free in the Linux kernel Bluetooth stack (net/bluetooth/hci_conn.c) allows an in-range attacker to corrupt kernel memory when the host processes an HCI_EV_NUM_COMP_PKTS event without properly locking hdev, letting hci_conn_tx_dequeue read a connection object already freed by a concurrent hci_conn_del/abort path. The flaw was found via KASAN fuzzing on kernel 6.16-rc7 and is fixed upstream; there is no public exploit identified at time of analysis and EPSS risk is low (0.17%).
WPBifröst WordPress plugin through version 1.0.7 allows low-privileged authenticated users to escalate to full administrative access. Subscribers and higher roles can exploit a missing capability check in the ctl_create_link AJAX handler to create new administrator accounts and immediately log in with full site control. With CVSS 8.8 (High) and EPSS data unavailable, severity is driven by the low privilege requirement (PR:L) and complete system compromise (C:H/I:H/A:H). No public exploit identified at time of analysis, and not listed in CISA KEV, but the attack is trivially automatable once an attacker holds any authenticated role.
Local privilege-to-kernel buffer overflow in the Linux kernel's hi311x (Holt HI-3110) CAN controller driver allows a user with network configuration capability to trigger an out-of-bounds heap write by injecting an oversized CAN XL frame. Because the driver never implemented ndo_change_mtu(), an attacker can raise the interface MTU beyond CAN_MTU and push a crafted frame through PF_PACKET whose length field (up to 0xff) is copied verbatim in hi3110_hw_tx(), overflowing an 8-byte buffer by up to 247 bytes. There is no public exploit identified at time of analysis, and the EPSS score is low (0.22%, 13th percentile); the issue has been resolved upstream in the mainline and stable kernel trees.
Local privilege-holders can trigger a kernel heap buffer overflow in the Linux mcba_usb CAN driver (Microchip CAN BUS Analyzer USB adapter) by raising the interface MTU beyond CAN_MTU and injecting a crafted CAN XL frame through a PF_PACKET raw socket. Because the driver never implemented ndo_change_mtu(), an attacker can set an oversized MTU (e.g. 9999), then send an ETH_P_CANXL frame whose flags byte is misread as the classic-CAN length field, causing memcpy to copy up to 247 bytes past the intended 8-byte buffer. This is a memory-corruption issue with high confidentiality, integrity and availability impact (CVSS 7.8); there is no public exploit identified at time of analysis, though the advisory includes a detailed reproduction, and EPSS is low at 0.22%.
Local privilege-context buffer overflow in the Linux kernel's ETAS ES58x CAN USB driver (etas_es58x) lets a user with network capabilities corrupt kernel memory by injecting oversized CAN XL frames. Because the driver never implemented ndo_change_mtu(), an attacker can raise the interface MTU beyond CAN limits, then use a PF_PACKET raw socket with ETH_P_CANXL to smuggle a frame whose length field (up to 0xff) is memcpy'd into an 8-byte buffer, overflowing it by up to 247 bytes. CVSS is 7.8 (High); there is no public exploit identified at time of analysis and EPSS is low (0.22%), consistent with the requirement for local access and specific ETAS hardware.
Local privilege-enabled buffer overflow in the Linux kernel's sun4i_can CAN controller driver (Allwinner A10/A20 SoCs) allows an attacker holding network-admin capability to write out of bounds by injecting oversized CAN XL frames. Because the driver never populated ndo_change_mtu(), the interface MTU can be raised past CAN_MTU, letting a PF_PACKET raw socket push a frame whose length field is misread as a CAN data length, overflowing a fixed buffer by up to 247 bytes. There is no public exploit identified at time of analysis and EPSS is low (0.22%), but the description includes a detailed, working reproduction path.
Use-after-free in the Linux kernel's iMON RC (remote control) driver (drivers/media/rc/imon.c) allows a local user with access to the device's VFD/LCD character-device interface to trigger memory corruption by racing writes against USB disconnect. The imon_disconnect() path unconditionally calls usb_put_dev() on usbdev_intf0/usbdev_intf1 without coordinating with in-flight writers, so a concurrent vfd_write()/send_packet() dereferences a freed usb_device pointer. Discovered via Syzkaller by the Linux Verification Center; no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.22%).
Local privilege escalation / memory-safety flaw in the Linux kernel eBPF verifier, where get_helper_proto could return a NULL helper function pointer when a required config option was disabled, causing the verifier to accept BPF programs referencing an invalid helper. On affected kernels a local user able to load eBPF programs can trigger a NULL/invalid function pointer condition leading to kernel crash or potential code execution (CVSS 7.8, high confidentiality/integrity/availability impact). No public exploit identified at time of analysis and EPSS is low (0.18%), consistent with a config-dependent, local-only bug rather than a widely exploited one.
Local privilege escalation and memory corruption in the Linux kernel's Mellanox/NVIDIA mlx5 networking driver arises from a use-after-free in the hardware-steering (HWS) flow-counter release path. When a flow rule tied to a local flow counter is deleted via the RDMA/InfiniBand verbs interface, mlx5_cmd_hws_delete_fte() releases an HWS action whose refcount and mutex were never initialized, and the counter struct may already be freed - allowing a local attacker with the ability to create and destroy flow rules to corrupt kernel memory. No public exploit has been identified at time of analysis; EPSS probability is low (0.17%, 7th percentile), and the issue is not in CISA KEV.
Local privilege escalation and memory corruption in the Linux kernel process-creation path arises because copy_process() takes the wrong error-exit label after futex_hash_allocate_default() fails, releasing tasklist_lock and siglock that were never acquired. This lock imbalance can corrupt kernel synchronization state on the fork error path, with a potential for kernel crash or exploitation to gain elevated privileges. No public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a subtle, hard-to-trigger error-handling defect rather than a widely-weaponized bug.
Local privilege escalation and memory corruption in the Linux kernel's fbcon (framebuffer console) subsystem stems from integer overflows in fbcon_do_set_font() when computing font buffer sizes from user-controlled parameters. A local, low-privileged attacker who can invoke the font-setting ioctl can trigger undersized allocations followed by heap buffer overflows during font data copying, potentially achieving code execution in kernel context. EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis; the fix has been merged and backported across stable kernel trees.
Local privilege escalation via memory corruption in the Linux kernel Bluetooth management (MGMT) subsystem allows a local attacker with Bluetooth management access to trigger a use-after-free of a struct mgmt_pending object. The flaw arises from a race between MGMT command completion callbacks and the pending-command list being freed (e.g. during device power-off), enabling reads/writes of freed slab memory that can corrupt kernel state. No public exploit identified at time of analysis, and EPSS is very low (0.03%); it is a KASAN-detected, fuzzer-reported issue rather than one with confirmed in-the-wild use.
Local privilege escalation and memory corruption in the Linux kernel's xc5000 DVB tuner driver (media subsystem) arises from a use-after-free in xc5000_release(): the function used cancel_delayed_work() which does not wait for an already-running timer_sleep delayed work item, so the xc5000_priv structure can be kfree()'d while the work callback still dereferences it. An attacker able to trigger tuner device teardown while the delayed work is active can win the race and cause the callback to operate on freed memory, potentially corrupting kernel memory. There is no public exploit identified at time of analysis and the flaw carries a low EPSS (0.22%); it was found via static analysis and fixed upstream.
Resource-exhaustion denial of service in the Linux kernel's Intel i40e (700-series Ethernet) driver allows a malicious or compromised Virtual Function to request an unbounded number of MAC/VLAN filters against its Physical Function, because the driver never enforced a maximum filter count. A guest controlling an SR-IOV VF can degrade or crash networking for the host PF and other VFs (CVSS 7.3, scope-changed). There is no public exploit identified at time of analysis, and the EPSS probability is low (0.20%, 10th percentile).
Memory disclosure and denial of service in the Linux kernel's SCSI target (LIO) subsystem arises when reading the configfs attribute exposed by target_lu_gp_members_show() in drivers/target/target_core_configfs.c. Because snprintf() returns the length it *would* have written, a combined HBA name plus device name exceeding the 256-byte LU_GROUP_NAME_BUF buffer causes the subsequent memcpy() to copy past the buffer, tripping the kernel's overflow detection and potentially leaking adjacent memory or crashing the host. This is no public exploit identified at time of analysis, with a low EPSS score of 0.24% (15th percentile) and no CISA KEV listing.
Local privilege escalation via memory corruption in the Linux kernel's iommufd subsystem allows a low-privileged local user to trigger a use-after-free by racing the abort path of IOMMU object allocation. Because fput() defers file release to a workqueue while the code immediately kfree()s the tied iommufd_object, the deferred release() decrements a users refcount on already-freed memory, corrupting the slab. Only pre-release 6.17-rc kernels are affected; EPSS is 0.10% (1st percentile) and there is no public exploit identified at time of analysis.