Remote code execution in alexusmai laravel-file-manager (versions 3.3.1 and earlier) lets an authenticated user with file-manager access run arbitrary PHP on the server by uploading a PHP payload disguised with a .png extension, then abusing the rename API to give it a .php extension so it executes when requested via a public URL. The flaw stems from client-side-only upload validation combined with an unrestricted rename operation and web-accessible storage. No CISA KEV listing; EPSS is a modest 0.55% (42nd percentile), but a dedicated GitHub repository referencing this CVE indicates public proof-of-concept material likely exists.
Uninitialized-memory disclosure in the Linux kernel's NFC NCI subsystem lets a local actor with access to the NCI interface trigger reads of unallocated skb->data by submitting NCI control packets whose declared header length passes the weak nic_valid_size() check but does not match the actual buffer layout expected per opcode. The flaw, found by Syzbot in nci_init_req, affects Linux kernels built with the NFC/NCI stack; it is tagged Information Disclosure with an EPSS of 0.21% (11th percentile) and no public exploit identified at time of analysis. Upstream fixes add per-handler parameter validation and silently drop malformed packets.
Improper enablement of IOMMU dirty page tracking in the Intel VT-d (iommu/vt-d) driver of the Linux kernel allows a misconfiguration where dirty tracking is offered even when the IOMMU performs incoherent page walks. Because the hardware cannot atomically update A/EA/D bits in non-snooped paging-structure entries, this triggers a non-recoverable fault and can corrupt or silently drop dirty-page state used during operations like VM live migration. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and this is a corrective hardening patch rather than an actively exploited flaw.
Improper accounting in the Linux kernel's io_uring zero-copy receive (zcrx) path allows a zcrx recv request to return more data than the caller requested, caused by desc->count being adjusted for all received buffers and then double-counted during recursive processing of frag-list skbs, leading to counter underflow. Affected are Linux kernels shipping the io_uring zcrx feature, where a local process using this interface can read beyond the intended receive limit. There is no public exploit identified at time of analysis, and EPSS is low (0.19%, 9th percentile), consistent with an internal kernel-hardening fix rather than an actively exploited flaw.
Local privilege-to-data compromise in the Linux kernel NTFS3 driver allows an attacker who can supply a crafted NTFS volume to bypass inode access checks and read or destroy arbitrary on-disk data. The flaw is an unvalidated integer overflow in run_unpack(), which decodes the compressed runlist ($DATA runs) mapping virtual clusters to logical clusters (LCNs); a forged runlist yields out-of-bounds LCNs. Rated CVSS 8.4 (high) with no public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and it is not in CISA KEV.
Information disclosure and memory-safety risk in the Linux kernel's TCP metrics (tcp_metrics) subsystem stems from three call sites using the non-lockdep-safe dst_dev() accessor, now replaced by the RCU-aware dst_dev_net_rcu() helper. Affected are Linux kernel builds prior to the fixing stable commits; a race in device/net dereference during TCP metric handling could expose kernel memory or destabilize the network stack. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the issue is not listed in CISA KEV.
Improper instruction emulation in the Linux kernel's KVM x86 subsystem allows a local user with access to KVM (typically /dev/kvm) to crash or destabilize the host hypervisor by racing port I/O interception changes against a userspace I/O exit. Because KVM re-checks L1 intercepts after it has already committed to emulating an L2 I/O access, a malicious or buggy VMM/guest can leave vcpu->arch.pio.count non-zero and trigger a kernel WARN in emulator_pio_in_out(); the flaw was discovered via a syzkaller reproducer. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.25%).
Local privilege escalation and denial of service in the Linux kernel's 9p (Plan 9) filesystem transport (net/9p/trans_fd.c) arises from a double request free in p9_fd_cancelled(). A race between p9_read_work() cancelling pending requests and p9_fd_cancelled() cleaning up a flush request causes the same req_list entry to be removed twice via list_del(), corrupting kernel list pointers (the classic 0xdead000000000100 poison), yielding a GPF/KASAN wild-memory-access that a local user can trigger by mounting a malicious 9p share. No public exploit identified at time of analysis; the flaw was found by the Linux Verification Center with Syzkaller, and EPSS is low at 0.22% (12th percentile).
Out-of-bounds/use-after-free read in the Linux kernel UDF (Universal Disk Format) filesystem driver allows a local attacker to crash the kernel or leak adjacent memory by getting a crafted or corrupted UDF image mounted and accessed. The flaw lies in fs/udf handling of the on-disk lengthAllocDescs field, which was not validated against the block size, causing udf_update_tag() to invoke crc_itu_t() on memory past the buffer. It was found by the Linux Verification Center via Syzkaller; there is no public exploit identified at time of analysis, and EPSS is low at 0.21% (12th percentile).
Improper return-value handling in the Linux kernel's vhost vringh host-side virtqueue library allows a local low-privileged actor (including a malicious or misbehaving guest driving a vhost/vDPA backend) to trigger processing of partially-copied descriptor data, potentially disclosing kernel memory. The vringh code checked copy_from_iter/copy_to_iter results for a negative error that these functions cannot return, so short (incomplete) copies were silently treated as success. No public exploit identified at time of analysis; EPSS is low at 0.20% (10th percentile) and the CVE is not in CISA KEV.
Local privilege escalation risk in the Linux kernel's io_uring waitid handling stems from a race condition in io_waitid_wait(), where a successful return failed to prune the task's entry from the wait queue when a cancelation was concurrently in progress, allowing the wait queue callback to be invoked twice against a stale entry. Authenticated local attackers (PR:L per CVSS) could exploit this to corrupt kernel memory with high confidentiality, integrity, and availability impact (CVSS 7.8). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Memory corruption in the Linux kernel's wcd937x ASoC audio codec driver occurs because the SoundWire port for the HPHL_COMP and HPHR_COMP compander components is set to zero, causing an out-of-bounds access at index -1 of the port_map array during driver operation. Local low-privileged users on devices using this Qualcomm codec can trigger kernel memory corruption (CVSS 7.8). There is no public exploit identified at time of analysis, EPSS risk is low (0.20%, 10th percentile), and the fix has already been merged upstream.
Local privilege escalation potential in the Linux kernel's ARM Statistical Profiling Extension (arm_spe) perf driver stems from an integer overflow in the PERF_IDX2OFF() calculation when an AUX ring buffer of 2 GiB or larger is used. On affected arm64 systems, a local user with permission to open SPE perf events can trigger the overflow because nr_pages was not cast to unsigned long, producing an incorrect buffer offset and out-of-bounds kernel memory access. This is a resolved kernel bug fixed via stable-tree commits; there is no public exploit identified at time of analysis and EPSS probability is low (0.20%, 10th percentile).
Local filesystem corruption / potential memory corruption in the Linux kernel's ntfs3 driver arises when an index allocation is performed against a $BITMAP attribute that is empty while index blocks already exist on disk. An attacker who can get a victim to mount a malformed NTFS image can drive the driver into an inconsistent index state during rename() of long filenames, causing subsequent operations to fail (-ENOENT) and reflecting on-disk corruption that the driver previously failed to reject. There is no public exploit identified at time of analysis, the EPSS probability is low (0.19%, 9th percentile), and it is not listed in CISA KEV.
Local privilege escalation via use-after-free in the Linux kernel's RDMA/rxe (Soft-RoCE) driver allows a low-privileged local user to corrupt kernel memory by winning a race in do_task(). When the task loop exhausts its iteration budget it blindly resets state to TASK_STATE_IDLE, overwriting a concurrent TASK_STATE_DRAINING set during rxe_cleanup_task()/rxe_disable_task() teardown, so a task reschedules against freed structures. No public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with a hard-to-win kernel race rather than a mass-exploited flaw.
Local privilege escalation and memory corruption in the Linux kernel's Android binder IPC driver arises from a double-free in the dynamic bitmap (dbitmap) allocator used for per-process reference tracking. When a process's dmap expansion fails, dbitmap_grow() frees the old bitmap, but the pointer is not cleared, so binder_proc_dec_tmpref() frees it a second time at process teardown, corrupting the kernel heap. This is a memory-safety flaw exploitable by any local user with binder access (default on Android and many Linux systems); there is no public exploit identified at time of analysis and the EPSS score is low (0.19%).
Use-after-free in the Linux kernel's F2FS (Flash-Friendly File System) encryption write path allows a local user to crash the kernel or corrupt memory during concurrent writes to encrypted files. The flaw lives in f2fs_merge_page_bio(), where a bounce/encrypted page can be freed by the write completion path (f2fs_write_end_io) while another thread still dereferences it via fio->encrypted_page in f2fs_is_cp_guaranteed(), producing a NULL/dangling pointer dereference. It is fixed upstream; no public weaponized exploit is identified, though the commit ships a race reproducer, and EPSS risk is low (0.19%).
Kernel panic (denial of service) in the Linux kernel's LoongArch BPF JIT compiler affects systems running on LoongArch (Loongson) 64-bit CPUs when BPF struct_ops programs - such as a BPF-based qdisc - are attached and their pointer return values are consumed by the kernel networking path. The LoongArch JIT epilogue sign-extended 32-bit return values as it does for ordinary BPF programs, but struct_ops functions must follow the LoongArch calling ABI, so a returned pointer (e.g. an skb from bpf_fifo_dequeue) was truncated/sign-extended into an invalid address that the kernel then dereferenced, causing an unhandled paging fault in __qdisc_run(). This is no public exploit identified at time of analysis and is not on CISA KEV; EPSS is low (0.19%, 9th percentile).
Kernel panic (and potential memory corruption) in the Linux kernel BPF JIT on the RISC-V architecture allows a local privileged actor to crash the system when a BPF struct_ops program (such as a bpf_qdisc scheduler) returns a pointer. The RISC-V JIT epilogue sign-extended struct_ops return values as if they were 32-bit scalars, violating the RISC-V calling convention and corrupting the returned 64-bit pointer, which the network qdisc path then dereferences. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and this affects only RISC-V builds using the BPF qdisc/struct_ops feature.
Memory/object reference leak in the Linux kernel's drm/msm (Qualcomm Adreno GPU) driver lets a local user with GPU device access leak kernel object references when the VM_BIND ioctl error path fails a handle lookup partway through, dropping already-obtained GEM object references incorrectly. It affects Linux kernels carrying the newer MSM VM_BIND uAPI and is patched upstream via kernel.org stable commits. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not listed in CISA KEV.
Local privilege escalation and memory corruption in the Linux kernel's SMC (Shared Memory Communications) subsystem allows a local user to trigger a use-after-free of a net_device during a connect() call on an SMC socket. The flaw lives in smc_pnet_find_ism_resource() / smc_pnet_find_roce_resource(), which dereference a destination device (dst->dev) that can be freed and swapped for blackhole_netdev before RTNL is acquired in pnet_find_base_ndev(). It was discovered by syzbot fuzzing; there is no public exploit identified at time of analysis, it is not on CISA KEV, and its EPSS probability is very low (0.17%, 7th percentile).
Local denial-of-service in the Linux kernel's F2FS filesystem allows an attacker who can mount a crafted F2FS image to trigger a kernel BUG_ON panic during a fallocate punch-hole operation. The flaw stems from missing validation of the node footer for non-inode direct nodes (dnodes), which lets a corrupted dnode be misparsed as an inode and produce an invalid truncation count. No public exploit has been identified at time of analysis and EPSS is low (0.17%, 7th percentile); reproduction requires a deliberately fuzzed on-disk image (syzbot-discovered).
Denial of service in Prevx 3.0.5.220 lets a local attacker terminate protected processes by sending IOCTL code 0x22E044 to the pxscan.sys kernel driver, which force-kills every process enumerated under the HKLM\System\CurrentControlSet\Services\pxscan\Files registry key. A GitHub repository named for the CVE indicates publicly available exploit code exists, though the vulnerability is not in CISA KEV and carries a low EPSS score of 0.34% (26th percentile). Prevx is a long-retired anti-malware product (absorbed into Webroot circa 2011), so real-world exposure is minimal.
Information disclosure in BESSystem (Baolande) BES Application Server through version 9.5.x lets remote unauthenticated attackers retrieve sensitive data by abusing the "pre-resource" option in the bes-web.xml deployment descriptor. The flaw exposes protected resources or configuration content over the network with no authentication (CVSS 7.5, C:H). No public exploit identified at time of analysis, though a third-party gist referencing the issue is linked in NVD; EPSS is low at 0.34% (26th percentile).
Denial of service in the Linux kernel's uio_hv_generic driver affects Hyper-V guest VMs that expose VMBus channels to userspace UIO drivers, where the kernel driver improperly manipulated the ring-buffer interrupt mask concurrently with user space. This race causes the guest user-mode driver to miss a host interrupt and hang indefinitely inside pread(), stalling the affected service. No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and it is not on the CISA KEV list.
Denial of service in the Linux kernel's D-Link dl2k Gigabit Ethernet driver (net/dlink, as used with hardware such as the D-Link DGE-550T) arises because the receive path did not check the return value of netdev_alloc_skb_ip_align() on the copy_thresh small-packet path; on allocation failure the code dereferenced skb->protocol, causing a NULL pointer dereference and kernel crash. Affected systems are Linux hosts using the dl2k driver for legacy D-Link Gigabit NICs. There is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low (0.21%, 11th percentile), consistent with a memory-pressure-dependent local DoS rather than a readily weaponizable remote flaw.
Host denial-of-service in the Linux kernel's KVM AMD (SVM) subsystem allows a guest VM to crash or hang the hypervisor host when the CPU/host is running with next-RIP support disabled (nrips=false). In that mode the WRMSR, HLT and INVD VM-Exit fastpath handlers attempt to decode and emulate the guest instruction to advance RIP, which reads guest memory and can sleep - but these handlers run with IRQs disabled, triggering a 'sleeping function called from invalid context' BUG and destabilizing the host. There is no public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile); despite the 7.1 CVSS the scope-changed availability impact is gated by a non-default configuration.
Out-of-bounds slab read in the Linux kernel's HFS+ filesystem driver (fs/hfsplus/unicode.c) allows a local low-privileged attacker to read adjacent kernel heap memory by triggering hfsplus_uni2asc() through the listxattr() path on a crafted/malformed HFS+ image. Because hfsplus_listxattr() passes a struct hfsplus_attr_unistr* whose layout differs from the struct hfsplus_unistr* the earlier fix (commit 94458781aee6) assumed, an oversized ustrlen drives the Unicode buffer pointer past the allocation. There is no public exploit identified at time of analysis, and EPSS is low (0.18%), consistent with a memory-disclosure primitive requiring local filesystem access rather than remote mass exploitation.
Link following vulnerability in AntiDupl.NET.WinForms.exe (versions through 2.3.12) allows local authenticated users to manipulate file operations during duplicate image deletion, potentially achieving unauthorized file access or modification with elevated integrity. Proof-of-concept exploit code exists (CVSS E:P). The vendor (ermig1979) was notified but has not responded, leaving users without an official patch.
Memory corruption in the Linux kernel's crypto compression subsystem (scomp/acomp) arises because struct layout randomization can reorder the alloc_ctx and free_ctx function pointers in scomp_alg independently of the crypto_acomp_streams struct that was built to mirror them, introduced by commit 42d9f6c77479. When the CONFIG_RANDSTRUCT hardening feature reorders these pure ops structures inconsistently, the kernel invokes the wrong context allocation/free callback, leading to high-impact confidentiality, integrity, and availability effects for a local low-privileged actor. No public exploit identified at time of analysis and EPSS probability is low (0.17%), so this is a hardening-regression fix rather than an actively exploited flaw.