Memory-management flaw in the Linux kernel VFS layer allows a local user with handle-lookup privileges to leak disconnected directory dentries by calling open_by_handle_at() on uncached inodes, eventually producing a 'Busy inodes after unmount' condition and unreclaimed kernel memory. The bug surfaces when reconnect_one() fails to find the target dentry and creates a replacement that is not flagged as disconnected, so dput() never immediately reclaims it - a regression exposed by commit f1ee616214cb, which stopped tracking most disconnected dentries on sb->s_anon. There is no public exploit identified at time of analysis, EPSS is low (0.19%, 9th percentile), and this is not in CISA KEV.
Out-of-bounds memory access in the Linux kernel's CIFS/SMB client (parse_dfs_referrals) allows a malicious or compromised SMB server to trigger memory corruption on connecting clients by returning a malformed FSCTL_DFS_GET_REFERRALS reply. The flaw affects Linux systems that mount SMB/CIFS shares and process DFS referrals, where a reply shorter than struct get_dfs_referral_rsp or claiming more referrals than it contains drives reads past the buffer. No public exploit identified at time of analysis, and EPSS is low (0.19%, 9th percentile), consistent with a client-side, server-triggered condition rather than mass-exploitable exposure.
Kernel NULL pointer dereference in the Linux USB gadget ACM function (f_acm) allows a local privileged operator to crash the kernel after a USB gadget bind/unbind cycle. After unbind, acm->notify_req is left stale; if a subsequent bind fails, the shared error path frees the stale request and dereferences a NULL ep->ops->free_request pointer in usb_ep_free_request(), producing a fatal oops. Tagged as a Denial of Service issue; EPSS is low (0.19%, 9th percentile), no public exploit is identified, and it is not listed in CISA KEV.
Local denial of service in the Linux kernel USB gadget NCM function driver (f_ncm) allows a privileged local user managing a USB peripheral-mode gadget to crash the kernel via a NULL pointer dereference. After a bind/unbind cycle leaves ncm->notify_req stale, a subsequent failing bind reaches a unified error path that frees the stale request, dereferencing ep->ops->free_request on a NULL endpoint. Tagged as Denial of Service; no public exploit identified at time of analysis and EPSS is low (0.19%).
Local denial-of-service in the Linux kernel's ixgbevf driver (Intel 10G SR-IOV virtual function driver) arises from broken mailbox API negotiation between PF and VF drivers. Since API 1.4/1.5/1.6, VF-specific features (IPsec offload, ESX enhanced mailbox) were bolted on without a feature-negotiation mechanism, causing crashes when the VF driver assumes support the underlying PF/kernel ixgbe driver does not actually implement. The fix introduces a new mailbox op so the VF queries the PF for supported features before enabling IPsec or ESX-specific paths. No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile) and there is no KEV listing.
Local memory corruption in the Linux kernel's DRM GPU scheduler (drm/sched) stems from a double free in drm_sched_job_add_resv_dependencies(), where a dma_fence reference that drm_sched_job_add_dependency() already consumed on its failure path is released a second time when the backing xarray fails to expand. Any local user able to submit GPU jobs on an affected kernel can trigger the flaw, leading to kernel memory corruption and denial of service. There is no public exploit identified at time of analysis, EPSS is low (0.19%), and it is not listed in CISA KEV.
Denial of service in the Linux kernel's USB gadget RNDIS function driver (f_rndis) lets a local privileged user crash the kernel via a NULL pointer dereference. After a bind/unbind cycle leaves rndis->notify_req stale, a subsequently failing bind reaches a unified error path that calls free_request on the stale request, dereferencing ep->ops->free_request on freed/NULL state. Tagged as Denial of Service; no public exploit is identified, EPSS is low (0.19%, 9th percentile), and it is not on CISA KEV.
Denial of service in the Linux kernel USB gadget CDC ECM function driver (f_ecm) allows a local privileged operator to crash the kernel via a NULL pointer dereference. After a USB gadget bind/unbind cycle, ecm->notify_req is left stale; if a later bind attempt fails, the shared error path tries to free the stale request and dereferences ep->ops->free_request through a NULL endpoint pointer. No public exploit identified at time of analysis and the practical impact is a kernel crash rather than the full confidentiality/integrity loss implied by the assigned 7.8 CVSS score.
Denial of service in the Tenda AC8 dual-band gigabit router (hardware revision v03.03.10.01) allows a remote attacker to crash the device by sending a single crafted packet to its UPnP service, triggering a stack-based buffer overflow (CWE-121). The flaw requires no authentication or user interaction per the CVSS vector (PR:N/UI:N) and impacts availability only (A:H, no confidentiality/integrity impact). Publicly available exploit material exists via a researcher GitHub repository, though the issue is not listed in CISA KEV and carries a modest EPSS score of 0.39% (31st percentile).
Denial of service in the Linux kernel's NFS server (NFSD) allows a pNFS client to crash the host by sending a LAYOUTCOMMIT operation against a FlexFiles-type layout, for which NFSD previously defined no proc_layoutcommit handler. Any system exporting files over pNFS with the FlexFiles layout driver is affected until patched. This is a stability/availability bug (no confirmed data compromise); no public exploit identified at time of analysis and it is not listed in CISA KEV, with a low EPSS of 0.20% (10th percentile).
Use-after-free memory corruption in X.Org X server's Xkb extension allows local authenticated attackers to achieve high confidentiality impact, low integrity impact, and high availability impact (CVSS 7.3) through improper resource cleanup during client disconnection. The vulnerability affects Red Hat Enterprise Linux distributions with multiple security advisories released (RHSA-2025:19432 through RHSA-2025:22055). EPSS data not provided, but the local attack vector (AV:L) and low complexity (AC:L) indicate exploitation requires authenticated local access. No CISA KEV listing or public POC identified at time of analysis.
Local privilege escalation in X.Org X server's Xkb extension affects RHEL-family distributions, allowing authenticated users to corrupt memory or crash the X server via integer overflow in XkbSetCompatMap(). Attack requires local access with low-privilege credentials. EPSS data not available; no CISA KEV listing indicates targeted rather than widespread exploitation. Red Hat has released patches across multiple RHEL versions (RHSA-2025:19432 through RHSA-2025:22055).
Use-after-free in X.Org X server and Xwayland during Present extension notification processing allows local authenticated users to achieve arbitrary code execution or denial of service. The flaw affects core display server components across multiple Linux distributions, with Red Hat confirming patches through 15 security advisories (RHSA-2025:19432 through RHSA-2025:22055). CVSS 7.3 reflects high integrity and availability impact with low confidentiality impact. No active exploitation confirmed (not in CISA KEV). EPSS data not provided, but the local attack vector and authentication requirement reduce remote exploitation risk despite the severity of potential impact.
Out-of-bounds memory read in the Linux kernel's hfsplus filesystem driver (fixed in 6.17-rc series) allows a local user to leak adjacent slab memory and crash the system when the kernel parses a maliciously crafted HFS+ volume. The flaw lives in hfsplus_strcasecmp() during B-tree catalog record comparison and is reached through ordinary path lookup on a mounted HFS+ image. No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), consistent with a local, filesystem-parsing memory-safety bug rather than a remotely weaponizable one.
Recursive rwsem deadlock in the Linux kernel's ksmbd SMB server subsystem causes ksmbd worker threads to hang indefinitely when any SMB client opens a named pipe, resulting in denial of service for all SMB connections. The flaw was introduced by commit 305853cce3794, which fixed a race condition in RPC handle list access but inadvertently created a deadlock: ksmbd_session_rpc_open acquires sess->rpc_lock as a write lock, then calls ksmbd_rpc_open → ksmbd_session_rpc_method, which attempts to re-acquire the same lock as a read lock - blocking the kernel worker thread indefinitely. No public exploit code exists and EPSS is 0.14% (4th percentile), but the trigger is deterministic and reliable against any ksmbd deployment once valid SMB credentials are obtained. This vulnerability is not in CISA KEV.
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() Return value of a function acpi_evaluate_dsm() is dereferenced without checking for NULL, but it is usually checked for this function. acpi_evaluate_dsm() may return NULL, when acpi_evaluate_object() returns acpi_status other than ACPI_SUCCESS, so add a check to prevent the crach. Found by Linux Verification Center (linuxtesting.org) with SVACE.
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Prevent access to vCPU events before init Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of uninitialized garbage for routing / injecting the exception. In one case the injection code and the hyp disagree on whether the vCPU has a 32bit EL1 and put the vCPU into an illegal mode for AArch64, tripping the BUG() in exception_target_el() during the next injection: kernel BUG at arch/arm64/kvm/inject_fault.c:40! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 3 UID: 0 PID: 318 Comm: repro Not tainted 6.17.0-rc4-00104-g10fd0285305d #6 PREEMPT Hardware name: linux,dummy-virt (DT) pstate: 21402009 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : exception_target_el+0x88/0x8c lr : pend_serror_exception+0x18/0x13c sp : ffff800082f03a10 x29: ffff800082f03a10 x28: ffff0000cb132280 x27: 0000000000000000 x26: 0000000000000000 x25: ffff0000c2a99c20 x24: 0000000000000000 x23: 0000000000008000 x22: 0000000000000002 x21: 0000000000000004 x20: 0000000000008000 x19: ffff0000c2a99c20 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200000c0 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffff800082f03af8 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffff800080f621f0 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 000000000040009b x1 : 0000000000000003 x0 : ffff0000c2a99c20 Call trace: exception_target_el+0x88/0x8c (P) kvm_inject_serror_esr+0x40/0x3b4 __kvm_arm_vcpu_set_events+0xf0/0x100 kvm_arch_vcpu_ioctl+0x180/0x9d4 kvm_vcpu_ioctl+0x60c/0x9f4 __arm64_sys_ioctl+0xac/0x104 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xf0 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Code: f946bc01 b4fffe61 9101e020 17fffff2 (d4210000) Reject the ioctls outright as no sane VMM would call these before KVM_ARM_VCPU_INIT anyway. Even if it did the exception would've been thrown away by the eventual reset of the vCPU's state.