Protection-mechanism bypass in BlueMail 1.140.103 and earlier on Windows lets attackers deliver files that are saved via the attachment-interaction feature without a Mark-of-the-Web (MOTW) tag, defeating Windows SmartScreen, Office Protected View, and third-party security software that rely on the MOTW zone identifier. Publicly available exploit code exists; the flaw is not listed in CISA KEV and EPSS is low (0.48%, 38th percentile), indicating no confirmed widespread exploitation yet. The practical effect is that a malicious document or executable arriving by email loses the 'downloaded from the Internet' provenance that would normally trigger a warning or block.
Protection-mechanism bypass in Canary Mail 5.1.40 and earlier on Windows lets attacker-supplied email attachments be written to disk without the Mark-of-the-Web (MOTW) NTFS tag, so files that reach a victim through the mail client are treated as trusted local content rather than internet-originated. This defeats SmartScreen, Office Protected View, and other MOTW-aware defenses in Windows and third-party software, materially easing malware delivery. Publicly available exploit code exists; the issue is not listed in CISA KEV and EPSS is low (0.48%, 38th percentile), indicating no evidence of widespread active exploitation.
Unauthenticated remote brute-force of the Dbit N300 T1 Pro wireless router (firmware V1.0.0) is trivially achievable because the /api/login endpoint imposes no rate limiting, account lockout, or throttling of any kind. Any attacker with network access to the management interface can attempt unlimited password guesses until admin credentials are found. A publicly available proof-of-concept exploit exists on GitHub; however, EPSS at 0.29% (21st percentile) and absence from CISA KEV suggest exploitation remains limited in practice, likely constrained by the product's small market footprint.
Kernel panic (denial of service) in the Linux kernel's qmi_wwan USB WWAN driver occurs because qmimux_rx_fixup() leaves skb->mac_header uninitialized for raw-IP packets that have no MAC header; on ARM64, strict-alignment access to that offset by xfrm/IPsec crashes the machine. The flaw is reachable when IPsec (ESP) traffic is received over a qmimux0 multiplexed interface, as shown by the provided oops in xfrm_input(). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile), consistent with a config-specific crash rather than broad remote code execution.
Use-after-free in the Linux kernel's libceph client (the in-kernel Ceph transport shared by CephFS and RBD) lets the mount-time wait loop in __ceph_open_session() read a monmap or osdmap structure after a worker thread has freed and replaced it. The flaw is a race between a mounting task polling have_mon_and_osd_map() without locks and ceph_monc_handle_map()/handle_one_map() swapping in a fresh map under their respective locks, producing a KASAN slab-use-after-free (reproducible with xfstests generic/395 and generic/397). There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is very low at 0.18% (8th percentile).
Out-of-bounds kernel memory write in the Linux kernel's libceph client (handle_auth_session_key) allows a malicious or compromised Ceph server to corrupt kernel memory when a client decrypts the connection secret or processes CephX service tickets. The attacker-controlled 'len' field from network packets was used without boundary checks, enabling potential kernel memory corruption and code execution against any host mounting Ceph/RBD storage. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.18%, 8th percentile).
Memory mishandling in the Linux kernel's mlx5e (NVIDIA/Mellanox ConnectX) RX path lets a loaded XDP program corrupt skb generation on striding RQ, causing kernel warnings, a BUG_ON crash, or erroneous packet buffers. The flaw affects systems using mlx5 NICs where a multi-buffer XDP program calls bpf_xdp_adjust_head() or bpf_xdp_adjust_tail() to change the xdp_buff layout, which the driver wrongly assumed was static. This is a resolved upstream kernel fix with no public exploit identified at time of analysis; EPSS is low at 0.17% (7th percentile) and it is not in CISA KEV.
Out-of-bounds kernel write in the Linux 'atlantic' network driver (Aquantia/Marvell AQC-series 10G NICs) occurs when the RX path receives large multi-descriptor packets exceeding MAX_SKB_FRAGS (17) fragments, causing a fragment index to overrun the skb frag array inside skb_add_rx_frag_netmem() and triggering a kernel panic. The flaw was observed crashing production systems equipped with the Aquantia AQC113 10G NIC. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.17% (6th percentile), consistent with a hardware-specific denial-of-service condition rather than a broadly exploitable RCE.
Local privilege escalation and memory corruption in the Linux kernel's NVMe driver arises from a use-after-free in admin request_queue lifetime management, where namespaces retain stale references to a controller's admin request_queue that can be dereferenced after the controller is torn down. Confirmed via a KASAN slab-use-after-free report in blk_queue_enter() triggered through an nvme ioctl (nvme_submit_user_cmd), the flaw affects hosts running NVMe storage and is fixed upstream by reordering the controller 'put' until after all references are released. EPSS is very low (0.03%, 7th percentile) and there is no public exploit identified at time of analysis; exploitation requires local access and a race against controller teardown.
Improper validation of node identifiers (nid) in the Linux kernel's F2FS filesystem allows a crafted or corrupted on-disk image to pass an out-of-range nid (where footer.ino equals footer.nid and both exceed valid bounds) through f2fs_alloc_nid() and free_nid_list, potentially causing out-of-bounds access, memory corruption, or a kernel crash. The upstream fix adds a sanity check to detect this corruption. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%, 6th percentile). Note the published CVSS 9.8 network vector appears inconsistent with the local, filesystem-image-driven nature of this bug.
Use-after-free in Linux ksmbd IPC handler allows remote unauthenticated attackers to trigger memory corruption via race condition in generic netlink reply processing. The flaw (CVSS 9.8 critical, network-reachable) affects ksmbd's ipc_msg_send_request() function where concurrent access to response buffers occurs without proper locking. EPSS data not provided; no CISA KEV listing identified at time of analysis. Multiple upstream kernel commits available across stable branches indicate vendor-released patches exist.
Local denial-of-service in the Linux kernel ext4 filesystem allows a low-privileged user to crash the system by racing inline-data destruction against block mapping. The function ext4_destroy_inline_data_nolock() flips an inode from EXT4_INODE_INLINE_DATA to EXT4_INODE_EXTENTS without holding i_data_sem, so a concurrent ext4_map_blocks() can enter ext4_ind_map_blocks() on an inode that already advertises extents, tripping a BUG_ON at fs/ext4/indirect.c:546 and panicking the kernel. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and the flaw is availability-only (kernel oops), not information disclosure despite the input tag.
Denial of service in the Linux kernel's netfilter nftables connection-tracking (nft_ct) code allows disruption of FTP passive-mode (PASV/EPSV) sessions on hosts acting as NAT gateways. When an nftables FTP conntrack helper is assigned to a connection that already has a NAT binding (helper set after DNAT), the required nfct_seqadj sequence-adjustment extension is never allocated, so the FTP payload mangling path hits a kernel WARNING and tears down the control connection ("Service not available, remote server has closed connection"); on kernels built with panic_on_warn this escalates to a full crash. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%), and it is not in CISA KEV.
PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload form. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Authorization bypass in the Linux kernel CephFS client (ceph module) lets an authenticated Ceph user exercise MDS auth capabilities granted for one filesystem against a different filesystem in a multi-filesystem (multifs) Ceph cluster. Because the kernel client failed to validate the fsname alongside the associated caps, a user holding read-only rights on 'fsname1' but read-write rights on 'fsname2' would incorrectly gain read-write on 'fsname1', enabling file creation and deletion they should not be permitted. No public exploit identified at time of analysis, and the EPSS score is low (0.25%, 16th percentile), consistent with a specialized storage-cluster condition rather than mass exploitation.
Adjacent-network stack buffer overflow in the Linux kernel's rtl8723bs staging Wi-Fi driver lets a nearby malicious station corrupt kernel stack memory by sending a crafted 802.11 Association Request. The OnAssocReq handler copied the Supported Rates IE into a fixed 16-byte stack buffer using the attacker-controlled IE length without bounds checking, enabling denial of service and potentially kernel code execution. Rated CVSS 8.8; no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with an unauthenticated but proximity-limited radio attack.
Use-after-free in the Linux kernel's SMB/CIFS client (cifs module) arises from an incomplete backport of commit bdb596ceb4b7, which left a stale kref_put() call in cfids_invalidation_worker() instead of converting it to close_cached_dir(). The flaw affects the cached-directory (cfid) invalidation path used when a Linux system mounts remote SMB shares, and with a CVSS of 8.8 (C:H/I:H/A:H) could allow memory corruption leading to information disclosure or code execution. There is no public exploit identified at time of analysis and the EPSS probability is low (0.15%).
Privilege-relevant use-after-free in the Linux kernel's drm/msm (Qualcomm Adreno GPU) driver allows a local user with GPU access to trigger kernel faults because last_fence is not waited on at VM-bind context close, freeing GPU resources while they are still in use. Affected systems run the msm DRM driver on Qualcomm SoCs and use vm_bind contexts. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.15%, 5th percentile), consistent with an in-tree kernel fix rather than an in-the-wild threat.
Use-after-free in the Linux kernel Bluetooth HCI core (hci_core) lets an attacker within Bluetooth range trigger a race between the ACL data RX path (l2cap_recv_acldata) and connection teardown (hci_abort_conn_sync/hci_conn_del), causing the RX handler to dereference a freed hci_conn structure. A syzkaller-reproduced crash confirms the flaw, which primarily manifests as denial of service though memory corruption cannot be excluded; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The issue is resolved upstream by moving the hci_conn lookup into the protocol receive handlers under a single RCU/lock-protected critical section.
Denial of service and out-of-bounds memory read in the Linux kernel's staging rtl8723bs Realtek Wi-Fi driver allows an attacker within radio range to crash or hang a vulnerable device by transmitting a malformed 802.11 frame. The rtw_get_ie() Information Element parser trusted the attacker-supplied IE length byte without bounds-checking, so a crafted length can push the parser past the frame buffer, producing OOB reads or an infinite loop. No public exploit is identified at time of analysis (EPSS 0.07%, 21st percentile) and the issue is not in CISA KEV; it has been fixed upstream and shipped in Ubuntu security updates.
Spip 4.1.10 contains a file upload vulnerability that allows attackers to upload malicious SVG files with embedded external links. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Themefic Hydra Booking for WordPress allows authenticated attackers to read sensitive database contents. The vulnerability affects versions up to 1.1.32 and is reachable over the network with low-privilege access. No public exploit is known and EPSS indicates low exploitation probability.
Blind SQL injection vulnerability in the LambertGroup CountDown With Image or Video Background WordPress plugin (versions up to 1.5) allows authenticated users with minimal privileges (e.g., subscriber) to extract sensitive database information. No active exploitation or public exploit code is known at this time, and EPSS indicates a very low probability of real‑world attacks.
Blind SQL injection in the xPromoter top_bar_promoter WordPress plugin versions up to 1.3.4 permits authenticated attackers with low privileges to extract sensitive data from the database. Exploitation requires sending crafted requests to a vulnerable plugin endpoint, potentially exposing user credentials and configuration details. No public exploit code or active exploitation has been reported, and EPSS score indicates a low probability of widespread attacks.
Blind SQL injection in the All In One SEO Pack WordPress plugin through version 4.9.1 allows authenticated attackers with subscriber-level access to execute arbitrary SQL queries, potentially extracting sensitive database contents.
SQL injection in LBG Zoominoutslider WordPress plugin versions through 5.4.4 allows authenticated attackers with low-level privileges to extract sensitive database information and potentially cause denial of service. The vulnerability enables cross-scope impact, meaning attackers can access resources beyond their authorized privilege level. EPSS probability is low (0.04%, 14th percentile), indicating limited observed exploitation activity, though Patchstack's disclosure suggests active security community awareness.
Network traffic sniffing in RTI Connext Professional 7.2.0-7.3.0 and 7.4.0-7.6.x exposes private personal information to unauthorized remote actors with low attack complexity. The vulnerability allows confidentiality breach (high impact) with limited integrity and availability impacts, affecting distributed data-sharing middleware used in critical infrastructure and industrial systems. EPSS exploitation probability is minimal (0.05%, 15th percentile) with no confirmed active exploitation or public exploit code identified at time of analysis.
Spurious kernel warnings in the Linux kernel hung_task blocker-tracking mechanism arise on architectures that align 32-bit values on 2-byte boundaries (e.g., m68k), where the code incorrectly assumes lock pointers are always 4-byte aligned so it can pack a type tag into the lower two pointer bits. The mismatch trips two WARN_ON_ONCE checks; the fix silently ignores non-4-byte-aligned locks, disabling the feature on those platforms. This is an internal kernel robustness fix rather than a remotely reachable attack primitive, with no public exploit identified at time of analysis and a low EPSS score of 0.15% (5th percentile).
Local privilege escalation potential in the Linux kernel's experimental Rust Binder driver (rust_binder) arises from a race condition on a node's death_list where NodeDeath entries can be concurrently manipulated. During Node::release the driver moves death entries to a stack-local list while other threads call an unsafe remove() on the original list, corrupting the prev/next pointers and producing kernel memory corruption (observed as a paging-request Oops on ARM64 Android 6.12 kernels). No public exploit has been identified and EPSS is low (0.20%), but the flaw yields high confidentiality, integrity, and availability impact if a local attacker wins the race.
Denial-of-service in the Linux kernel JFS filesystem driver lets a local low-privileged actor crash the system by mounting a JFS volume read-only. Because txInit() started its waitqueue-initialization loop at index 1, TxBlock[0].waitor is left uninitialized; a read-only mount returns tid=0 and the subsequent txEnd(0) dereferences that uninitialized waitqueue, triggering a lockdep 'non-static key' warning and a kernel crash. EPSS is low (0.18%, 8th percentile), there is no public exploit identified at time of analysis, and it is not in CISA KEV - impact is a crash rather than code execution.
Out-of-bounds read in the Linux kernel HFS+ (hfsplus) filesystem driver allows a local attacker to crash the kernel via a crafted HFS+ B-tree node whose record offset or length in hfsplus_bmap_alloc exceeds node_size, causing access beyond the node's allocated pages. The flaw is reached during node allocation (hfs_btree_inc_height → hfsplus_brec_insert) when writing to files on a malicious HFS+ image, with KASAN confirming a slab-out-of-bounds read. Reported as a denial-of-service issue with a low EPSS score (0.18%, 8th percentile); no public exploit identified at time of analysis and it is not in CISA KEV.
Denial of service in the Linux kernel's AMD GPU display driver (amdgpu drm/amd/display) allows a local user to crash the system via a NULL pointer dereference in dc_stream_get_scanoutpos(). The flaw triggers during concurrent atomic modeset and cursor operations - reproducible with the IGT kms_cursor_legacy 'long-nonblocking-modeset-vs-cursor-atomic' test when both an eDP panel and a DP monitor are connected. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and this is not in CISA KEV.
Out-of-bounds memory access in the Linux kernel's eBPF verifier (widen_imprecise_scalars()) allows a local actor able to load eBPF programs to read or corrupt kernel memory beyond the bpf_verifier_state stack array. The flaw arises because the verifier assumed an ancestor state (prev_st) shares the same allocated_stack depth as a newly queued state (queued_st), which is false when the same callsite is invoked with differently sized stack frames. No public exploit has been identified at time of analysis; EPSS risk is low (0.17%, 7th percentile) and the issue has been resolved upstream.
Integrity protection weakening in the Linux kernel's IMA (Integrity Measurement Architecture) subsystem allows a stored IMA file signature to be silently downgraded to a plain IMA hash. When IMA and EVM run in fix mode (e.g. booting with 'ima_appraise=fix evm=fix ima_policy=appraise_tcb'), the kernel incorrectly clears the IMA_DIGSIG flag whenever a non-IMA security xattr (such as security.selinux or security.evm) or an ACL is set or removed after security.ima was written, so on file close a hash is generated instead of preserving the intended signature. A full C reproducer is embedded in the report, but there is no CISA KEV listing and no public weaponized exploit identified at time of analysis; EPSS is 0.17% (7th percentile).
Kernel crashes and memory corruption in the Linux kernel on IBM s390/s390x systems occur when the HugeTLB Vmemmap Optimization (HVO) feature is enabled, because s390 architecture rules forbid overwriting an active/valid page table entry with another valid entry without first invalidating it, and the HVO path modifies kernel page tables without a compliant TLB flush. The upstream fix disables ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP on s390, effectively reverting the patch that enabled it. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is tagged as a Denial of Service issue rather than an exploitation primitive.
Cross-task FPU state leakage in the Linux kernel x86 XFD (Extended Feature Disable) handling allows a local low-privileged task to trigger an inconsistent AMX/dynamic-feature register state during signal delivery. When a non-AMX task is preempted by an AMX-enabled task that changes the XFD MSR, fpu__clear_user_states() failed to re-synchronize XFD, producing a state mismatch (kernel WARNING) and potential exposure of dynamic FPU register contents. Tagged as an information-disclosure issue; no public exploit identified at time of analysis and EPSS is low (0.17%, 7th percentile).
Local privilege escalation and memory corruption in the Linux kernel's Intel Xe GPU driver (drm/xe/guc) arises from a use-after-free race during device unbind: the GuC 'Dead CT' worker is not synchronized with the unbind path, so it can access GuC communication-transport resources after they have already been freed. Exploitation requires local access with low privileges (CVSS 7.8, AV:L/PR:L) and can result in high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the low EPSS (0.17%) reflects the niche, timing-dependent nature of the flaw.
Local privilege-escalation-class use-after-free in the Linux kernel's radeon (AMD GPU) DRM driver, triggered on the probe-error and device-removal paths. After the driver switched its main structure to devm_drm_dev_alloc(), the leftover drm_put_dev() calls cause devres to release the already-freed device a second time, producing a refcount underflow ('refcount_t: underflow; use-after-free') and dangling reference. No public exploit identified at time of analysis; EPSS is low at 0.17% (7th percentile) and the issue is not listed in CISA KEV.
Kernel memory corruption in the Linux drm/radeon GPU driver occurs because the driver calls kfree() on the rdev main structure that is now managed by devres (via devm_drm_dev_alloc()), causing a double-free when the driver probe fails and devres later cleans up the already-freed allocation. Local users on systems with AMD/ATI Radeon hardware may trigger memory corruption during a failed driver probe, most directly resulting in a kernel crash. There is no public exploit identified at time of analysis, and the EPSS score is low (0.17%, 7th percentile), consistent with an error-path bug rather than a broadly exploitable flaw.
Denial-of-service via invalid pointer access exists in the Linux kernel gpiolib debugfs interface, where a failed memory allocation in gpiolib_seq_start() leaves s->private uninitialized and later dereferenced in gpiolib_seq_stop(), crashing the kernel. The flaw affects systems exposing the GPIO debugfs seq_file (/sys/kernel/debug/gpio) and is triggerable only under memory-allocation failure. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and it is not on CISA KEV.
Kernel memory corruption in the Linux kernel's AMD Display (amdgpu/DC) driver stems from an undersized dc->links[MAX_LINKS] array and an unchecked link->enc pointer, letting a local attacker on AMD-GPU systems trigger an out-of-bounds access and NULL-pointer dereference during hw_init() for DisplayPort-over-USB4 (DPIA) endpoints. Rated CVSS 7.8 (AV:L/PR:L) and tagged as denial-of-service, it most realistically causes a kernel crash. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.17% (7th percentile).
Kernel memory corruption in the Linux platform/x86 Intel P-Unit IPC driver (intel_punit_ipc) arises from an interrupt handler dereferencing the address of a global pointer variable (&punit_ipcdev) instead of the pointer itself, so the completion call complete(&ipcdev->cmd_complete) in intel_punit_ioc() writes to an incorrect memory location. Affected systems are those running the punit_ipc driver on specific Intel SoC platforms; a local low-privileged actor able to drive the IPC command path can corrupt kernel memory, most plausibly causing instability or a crash. There is no public exploit identified at time of analysis, EPSS is very low (0.17%, 6th percentile), and the issue is not in CISA KEV.
Local privilege escalation and memory corruption in the Linux kernel's io_uring networking subsystem stems from vectored registered buffer imports being tied to the wrong io_kiocb (the request 'req' instead of the notification 'sr->notif'), creating an object-lifetime mismatch. Local low-privileged users on affected kernels can trigger use-after-free-style conditions leading to information disclosure or code execution in kernel context. No public exploit identified at time of analysis, and EPSS is low (0.16%).
Local privilege-level information disclosure and memory corruption in the Linux kernel's VFS statmount() implementation arises from an uninitialized output-offset pointer ('offp') in statmount_string(). When a caller requests the STATMOUNT_MNT_UIDMAP or STATMOUNT_MNT_GIDMAP fields, those code paths write directly to the struct fields and never assign 'offp', so a later dereference of the uninitialized pointer can leak kernel memory or corrupt state. The CVSS 3.1 vector (AV:L/PR:L) indicates a local, low-privileged attacker is required; there is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile).
Improper GEM object cleanup in the Linux kernel's drm/msm (Qualcomm Adreno) graphics driver mishandles imported dma-bufs, because the free path only checked object flags without accounting for imported buffers whose reservation object differs from the embedded default. A local user with DRM/GPU access can trigger the faulty path (reproduced during hardware-accelerated IRIS video playback under GNOME Shell) by closing a GEM handle backed by an imported dma-buf, producing a kernel WARNING at msm_gem.c:1127 and potential incorrect reservation-object handling during buffer teardown. There is no public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and this is not on CISA KEV.
Local denial-of-service (and potential memory corruption) in the AMD amdkfd (Kernel Fusion Driver) component of the Linux kernel arises from a race between GPU compute-partition switching and asynchronous KFD process teardown. Because the driver's partition-switch path only checks whether the kfd_processes_table is empty - while the actual kfd_process teardown runs later in the kfd_process_wq workqueue - a partition switch can free kfd_node structures still being accessed by an in-flight release, producing a divide-by-zero kernel oops (observed in kfd_get_num_sdma_engines). No public exploit identified at time of analysis, EPSS is low (0.16%), and it is not listed in CISA KEV.
Local privilege-relevant memory corruption/disclosure risk exists in the Linux kernel's Rockchip SFC (Serial Flash Controller) SPI driver (spi-rockchip-sfc), where improper DMA-API usage - deriving DMA addresses via virt_to_phys() instead of dma_map_single() - causes the driver to sync DMA memory it never properly mapped. On affected Rockchip-based systems (e.g. ODROID-M1), this triggers a DMA-API debug warning and reflects an underlying unsafe memory-transfer path during SPI-NOR flash operations. No public exploit identified at time of analysis; EPSS probability is low (0.16%, 6th percentile).
Local privilege-context memory corruption in the Linux kernel's io_uring zero-copy send (zctx) path allows a local user to trigger unsafe handling of chained notification (ubuf_info) contexts. The flaw stems from send-zerocopy operations linking ubuf_info structures that may originate from a different io_uring context than assumed, and the fix adds a check enforcing that only same-context notifications are chained. No public exploit has been identified at time of analysis; EPSS is very low (0.16%, 6th percentile) and the issue is not on the CISA KEV list, but the CVSS base score of 7.8 reflects high confidentiality, integrity, and availability impact for a successful local trigger.
Local privilege-relevant memory corruption in the Linux kernel's io_uring cmd_net timestamp-retrieval path arises from transposed arguments to skb_queue_splice(), causing SKBs to be spliced in the wrong direction between the socket queue and an on-stack list. Any local user able to issue io_uring network commands with timestamp retrieval could trigger the flawed splice, potentially leading to information disclosure (per source tagging) or broader list/memory corruption. There is no public exploit identified at time of analysis and EPSS is low (0.15%), so this is a code-quality/security hardening fix rather than an actively exploited threat.
Local denial-of-service (and potential memory corruption) in the Linux kernel's NXP i.MX8 ISI media capture driver (imx8-isi) allows a low-privileged user with access to an ISI /dev/videoX device to trigger a WARNING and driver error state by simply querying device controls while a capture stream is active. The flaw stems from mxc_isi_video_release() unconditionally tearing down streaming state, so any release call (e.g. from `v4l2-ctl -l`) can free a queue that is still streaming. No public exploit is identified at time of analysis and EPSS risk is negligible (0.03%), though a deterministic crash-reproduction recipe is published in the fix commit.