Protection-mechanism bypass in BlueMail 1.140.103 and earlier on Windows lets attackers deliver files that are saved via the attachment-interaction feature without a Mark-of-the-Web (MOTW) tag, defeating Windows SmartScreen, Office Protected View, and third-party security software that rely on the MOTW zone identifier. Publicly available exploit code exists; the flaw is not listed in CISA KEV and EPSS is low (0.48%, 38th percentile), indicating no confirmed widespread exploitation yet. The practical effect is that a malicious document or executable arriving by email loses the 'downloaded from the Internet' provenance that would normally trigger a warning or block.
Protection-mechanism bypass in Canary Mail 5.1.40 and earlier on Windows lets attacker-supplied email attachments be written to disk without the Mark-of-the-Web (MOTW) NTFS tag, so files that reach a victim through the mail client are treated as trusted local content rather than internet-originated. This defeats SmartScreen, Office Protected View, and other MOTW-aware defenses in Windows and third-party software, materially easing malware delivery. Publicly available exploit code exists; the issue is not listed in CISA KEV and EPSS is low (0.48%, 38th percentile), indicating no evidence of widespread active exploitation.
Kernel panic (denial of service) in the Linux kernel's qmi_wwan USB WWAN driver occurs because qmimux_rx_fixup() leaves skb->mac_header uninitialized for raw-IP packets that have no MAC header; on ARM64, strict-alignment access to that offset by xfrm/IPsec crashes the machine. The flaw is reachable when IPsec (ESP) traffic is received over a qmimux0 multiplexed interface, as shown by the provided oops in xfrm_input(). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile), consistent with a config-specific crash rather than broad remote code execution.
Use-after-free in the Linux kernel's libceph client (the in-kernel Ceph transport shared by CephFS and RBD) lets the mount-time wait loop in __ceph_open_session() read a monmap or osdmap structure after a worker thread has freed and replaced it. The flaw is a race between a mounting task polling have_mon_and_osd_map() without locks and ceph_monc_handle_map()/handle_one_map() swapping in a fresh map under their respective locks, producing a KASAN slab-use-after-free (reproducible with xfstests generic/395 and generic/397). There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is very low at 0.18% (8th percentile).
Out-of-bounds kernel memory write in the Linux kernel's libceph client (handle_auth_session_key) allows a malicious or compromised Ceph server to corrupt kernel memory when a client decrypts the connection secret or processes CephX service tickets. The attacker-controlled 'len' field from network packets was used without boundary checks, enabling potential kernel memory corruption and code execution against any host mounting Ceph/RBD storage. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.18%, 8th percentile).
Memory mishandling in the Linux kernel's mlx5e (NVIDIA/Mellanox ConnectX) RX path lets a loaded XDP program corrupt skb generation on striding RQ, causing kernel warnings, a BUG_ON crash, or erroneous packet buffers. The flaw affects systems using mlx5 NICs where a multi-buffer XDP program calls bpf_xdp_adjust_head() or bpf_xdp_adjust_tail() to change the xdp_buff layout, which the driver wrongly assumed was static. This is a resolved upstream kernel fix with no public exploit identified at time of analysis; EPSS is low at 0.17% (7th percentile) and it is not in CISA KEV.
Out-of-bounds kernel write in the Linux 'atlantic' network driver (Aquantia/Marvell AQC-series 10G NICs) occurs when the RX path receives large multi-descriptor packets exceeding MAX_SKB_FRAGS (17) fragments, causing a fragment index to overrun the skb frag array inside skb_add_rx_frag_netmem() and triggering a kernel panic. The flaw was observed crashing production systems equipped with the Aquantia AQC113 10G NIC. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.17% (6th percentile), consistent with a hardware-specific denial-of-service condition rather than a broadly exploitable RCE.
Improper validation of node identifiers (nid) in the Linux kernel's F2FS filesystem allows a crafted or corrupted on-disk image to pass an out-of-range nid (where footer.ino equals footer.nid and both exceed valid bounds) through f2fs_alloc_nid() and free_nid_list, potentially causing out-of-bounds access, memory corruption, or a kernel crash. The upstream fix adds a sanity check to detect this corruption. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%, 6th percentile). Note the published CVSS 9.8 network vector appears inconsistent with the local, filesystem-image-driven nature of this bug.
Use-after-free in Linux ksmbd IPC handler allows remote unauthenticated attackers to trigger memory corruption via race condition in generic netlink reply processing. The flaw (CVSS 9.8 critical, network-reachable) affects ksmbd's ipc_msg_send_request() function where concurrent access to response buffers occurs without proper locking. EPSS data not provided; no CISA KEV listing identified at time of analysis. Multiple upstream kernel commits available across stable branches indicate vendor-released patches exist.