Shift-out-of-bounds vulnerability in Linux kernel HID core driver allows local authenticated attackers to cause denial of service via crafted HID device report descriptors with oversized fields that trigger undefined bit-shift operations in the s32ton() function. A malicious or malfunctioning HID device can supply a report_size value up to 256, causing shifts on 32-bit integers with exponents exceeding safe limits, crashing the kernel or triggering undefined behavior. CVSS 5.5 reflects local-only attack vector with low complexity and requirement for user/driver privileges to process HID output reports.
Denial of service via skb_shared_info->frags[] buffer overflow in the CDC Phonet USB driver allows local attackers with USB device access to crash the kernel by sending unbounded sequences of full-page bulk transfers. A malicious or compromised USB modem device can trigger this overflow without authentication or user interaction. The vulnerability has a low EPSS score (0.02%) despite moderate CVSS (5.5), indicating exploitation requires specific local USB hardware control.
Null pointer dereference in Linux kernel bnge driver occurs when auxiliary_device_add() fails and the error handling path omits a return statement after auxiliary_device_uninit(), causing subsequent code to dereference a freed and nullified auxr_dev pointer. Local users with limited privileges can trigger kernel panic (denial of service) by inducing auxiliary device initialization failure. EPSS score of 0.02% reflects low real-world exploitation probability despite availability of vendor patches in stable branches 6.19.14 and 7.0.1.
Denial of service via out-of-bounds string lookup in Linux kernel ALSA fireworks driver allows local authenticated users to crash the system by supplying an invalid status value from a firewire device. The vulnerability stems from insufficient bounds checking on a 32-bit status field before array indexing into a 17-entry string table, enabling memory access violations when the device reports unexpected values including EFR_STATUS_INCOMPLETE (0x80000000).
Divide-by-zero denial of service in Linux kernel framebuffer driver tdfxfb allows local authenticated users to crash the system by issuing a malformed FBIOPUT_VSCREENINFO ioctl with zero pixclock value. The vulnerability affects the framebuffer video mode setting functionality when pixclock is used directly in division operations without validation, triggering a kernel panic.
Integer underflow in the Linux kernel's USB NCM gadget driver allows a malicious USB host to bypass buffer boundary checks and copy adjacent kernel memory into network packet buffers. The vulnerability exists in ncm_unwrap_ntb() where block_len values smaller than the NDP size cause unsigned integer underflow in bounds validation, enabling out-of-bounds memory read and potential information disclosure. Affected versions prior to Linux 6.12.83, 6.18.24, 6.19.14, and 7.0.1 require patching; exploitation requires local USB device attachment or administrative USB gadget configuration.
Memory corruption via skb fragment array overflow in the USB Phonet gadget driver allows local attackers with device-level USB host capabilities to cause denial of service. The vulnerability exists in pn_rx_complete() which fails to enforce the MAX_SKB_FRAGS limit when processing unbounded full-page OUT transfers, causing heap memory corruption adjacent to the skb_shared_info structure. A malicious or misconfigured USB host sending continuous PAGE_SIZE byte transfers triggers the flaw in gadgets exposing the Phonet function, confirmed fixed in Linux 6.12.83, 6.18.24, 6.19.14, and 7.0.1.
Null pointer dereference in the Renesas USB3 gadget driver allows local authenticated attackers to trigger a denial of service by sending crafted USB standard requests with invalid endpoint indices that bypass validation in GET_STATUS and SET/CLEAR_FEATURE handlers. The vulnerability affects multiple stable kernel versions and requires local access with user-level privileges, resulting in potential system crash or service disruption.
Kernel oops and denial of service in the Linux kernel USB gadget HID driver (`f_hid`) occurs when `cdev_init` reinitializes an in-use character device during a USB gadget unbind/rebind cycle while `/dev/hidg*` remains open. A local attacker with low privileges who holds a file descriptor to `/dev/hidg0` open during a rebind operation can trigger a kernel oops, crashing the affected system. No public exploit exists and EPSS probability is 0.02% (5th percentile), indicating negligible exploitation interest; however, patched kernel versions are available across multiple stable branches.
Divide-by-zero crash in the Linux kernel's udlfb (USB DisplayLink framebuffer) driver allows a local low-privileged user to trigger a kernel panic via the FBIOPUT_VSCREENINFO ioctl when pixclock is zero. The flaw, classified CWE-369, mirrors an identical class of defect previously corrected in the fb_pm2fb driver (commit 19f953e74356). Patched kernel versions are available across multiple stable branches; no public exploit or active exploitation has been identified at time of analysis.
Division-by-zero in the sm750fb staging framebuffer driver allows a local low-privileged user to crash the kernel. By submitting a FBIOPUT_VSCREENINFO ioctl with pixclock set to zero, an attacker triggers an unvalidated division in ps_to_hz(), called from hw_sm750_crtc_set_mode(), resulting in a kernel panic and full denial of service. No public exploit code has been identified and EPSS is 0.02% (5th percentile), consistent with a locally-reachable, hardware-dependent crash with no remote or confidentiality impact.
Kernel panic in the Linux xe/vfio driver causes a denial-of-service when a reset is triggered on SR-IOV Virtual Function (VF) devices that do not support live migration. The xe_vfio_pci_core_device struct members required by reset handling are only initialized during migration setup, leaving them NULL for non-migration VFs; writing to the sysfs reset attribute of such a VF dereferences the uninitialized pointer and crashes the kernel. No public exploit has been identified, EPSS is 0.02% (5th percentile), and exploitation requires a narrow hardware and configuration prerequisite - Intel Xe GPU with SR-IOV and VFIO passthrough enabled.
NULL pointer dereference in the Linux kernel's vidtv virtual DVB-T test driver allows a local low-privileged user to crash the kernel, resulting in a denial-of-service. The flaw resides in vidtv_channel_pmt_match_sections(), which calls vidtv_psi_pmt_stream_init() without validating whether the return value is NULL on memory allocation failure; a subsequent field access on the NULL pointer triggers a general protection fault. No public exploit or active KEV-listed exploitation exists; EPSS at 0.02% (5th percentile) reflects negligible real-world exploitation probability.
Kernel panic in the Linux kernel's ocfs2 (Oracle Cluster File System 2) resize path allows a local low-privileged user to crash the system via a crafted filesystem image. The ocfs2_group_extend() function in fs/ocfs2/resize.c:308 unconditionally asserts that the global bitmap buffer contains a valid dinode signature using BUG_ON, but the JBD2 journaling layer's buffer path bypasses structural validation, permitting an invalid dinode to reach the resize ioctl and trigger a kernel BUG. No active exploitation is confirmed (not in CISA KEV), and EPSS stands at 0.02% (5th percentile), reflecting minimal exploitation activity; patches are available across multiple stable kernel branches.
Kernel panic in the Linux pci-epf-vntb driver allows a local low-privileged user to crash the system by triggering a race between the delayed cmd_handler work queue and the epf_ntb_epc_cleanup teardown path. When cleanup frees BAR mappings and doorbells without first canceling the pending work, the handler subsequently dereferences invalid virtual addresses and produces a fatal kernel oops. Affected systems are limited to those with PCIe NTB endpoint hardware and the pci_epf_vntb module loaded; no public exploit exists and EPSS is 0.02%, reflecting negligible exploitation probability.
Host kernel panic in Linux KVM's AMD SEV-SNP subsystem allows a local attacker with KVM device access to crash the host by issuing a VMSA synchronization ioctl after a vCPU has already been launched and its VMSA encrypted. On SNP-enabled hosts, this write access violates the Reverse Map Table (RMP) hardware protection, producing an unrecoverable RMP page fault that panics the host kernel and terminates all co-located guest VMs simultaneously. No public exploit or active exploitation has been identified; vendor-released patches are available for stable kernel series 6.12.83, 6.18.24, 6.19.14, and 7.0.1.
Denial-of-service in the Linux kernel KVM SEV subsystem allows a local low-privileged user to trivially trigger a kernel WARN in sev_pin_memory() by submitting a crafted KVM_MEMORY_ENCRYPT_REG_REGION ioctl with an oversized region (e.g., size set to the maximum u64 value), causing npages to overflow a signed int. On kernels configured with panic_on_warn=1, this directly results in a kernel panic and full system crash. No public exploit has been identified at time of analysis and CISA has not added this to the KEV catalog, though the CVE description itself provides a working proof-of-concept reproducer.
State corruption and memory leak in the Linux kernel's vidtv virtual DVB test driver allow a local low-privileged user to cause kernel memory exhaustion. When vidtv_start_streaming() fails inside vidtv_start_feed(), the nfeeds counter is incremented but never rolled back, desynchronizing driver state so that subsequent start calls skip mux initialization and stop calls exit early without freeing partially allocated mux and channel resources. No public exploit exists and EPSS is 0.02% (5th percentile), reflecting the niche nature of the affected test driver component.
NULL pointer dereference in the Linux kernel's nilfs2 filesystem driver allows a local, low-privileged attacker to crash the kernel by invoking the NILFS_IOCTL_CLEAN_SEGMENTS ioctl immediately after mounting a nilfs2 filesystem, before the DAT inode's btree node cache is lazily initialized. The impact is a general protection fault and full denial of service; no confidentiality or integrity impact is possible. No public exploit is known at time of analysis, and EPSS at 0.02% (5th percentile) reflects extremely low real-world exploitation probability.
Timer interrupt starvation in the Linux kernel clockevents subsystem results from the `next_event_forced` flag not being reset across three distinct code paths: clock event state transitions (shutdown/startup), non-forced event arming when a far-future event follows, and the suspend wakeup handler. This stale flag prevents timer rearming and causes system stalls, confirmed by multiple user reports. The vulnerability carries a CVSS 5.5 (Medium) score, is not listed in CISA KEV, and EPSS rates it at 0.02% (5th percentile), placing it firmly in the reliability-defect category rather than active exploitation risk. Patch commit 9401b593fa48218d2667df1610b0ebc518554880 is available in Linux 7.0.1.
Kernel panic in the Linux hantro_vpu media driver (verisilicon subsystem) allows a local low-privileged user to crash the system by triggering a device probe deferral or unbind-bind cycle on affected NXP i.MX8MQ hardware. The root cause is an incorrect __initconst annotation on the imx8mq_vpu_shared_resources array, which causes the kernel to free that data after module initialization while variant structures retain a live pointer to it; subsequent probe calls dereference freed memory and fault. No public exploit or PoC exists and this CVE is not in CISA KEV; the EPSS score of 0.02% (5th percentile) confirms negligible real-world exploitation probability.
Pointer arithmetic type confusion in the Linux kernel's LoongArch KVM EIOINTC register access handler allows a local low-privileged attacker to crash the host kernel. The function kvm_eiointc_regs_access() stores the register array base address as a u64 rather than a void pointer, causing byte offsets to be scaled incorrectly during address calculation and producing out-of-bounds memory accesses that result in a kernel panic. No public exploit code exists and EPSS sits at 0.02%, consistent with the narrow LoongArch KVM attack surface; the vulnerability is not listed in CISA KEV.
The Linux kernel's x86 FRED (Flexible Return and Event Delivery) initialization path crashes AMD SEV-ES, SEV-SNP, and Intel TDX confidential VM guests via triple fault when any exception is triggered during the brief AP initialization window before FRED MSRs are configured. A prior attempted mitigation introduced a secondary risk: temporarily disabling CR4 pinning for offline CPUs created a path where a local attacker could flip a single RW-memory bit (the CPU online flag) to suppress CR4 security controls and disable SMEP/SMAP protections. No public exploit has been identified at time of analysis; EPSS is 0.02% (5th percentile), consistent with the narrow real-world exploitability of this flaw.
Null pointer dereference in the Linux kernel's spi-dw-dma driver crashes the system when an error occurs during a DMA transaction and the current SPI message pointer is NULL at the time error-log printing is attempted. Systems running the DesignWare SPI DMA driver are exposed to a local denial-of-service condition triggerable by a low-privileged user. No public exploit exists and EPSS probability is 0.02% (5th percentile), indicating negligible current exploitation interest; however, the crash path is deterministic once the error condition is induced.
Missing lock release in the Linux kernel's XFS quota scrub subsystem allows a local, low-privileged user to trigger a dquot lock leak that can cause deadlocks in subsequent quota operations. The flaw exists in xchk_quota_item, which can exit early after xchk_fblock_process_error without releasing dq->q_qlock. This denial-of-service condition affects kernels from the introducing commit 7d1f0e167a06 through the respective stable branch fix points; no public exploit exists and EPSS is at the 5th percentile, indicating low real-world exploitation probability.
Missing runtime power management reference in the Linux kernel's Intel Xe GPU driver (drm/xe) allows a local low-privileged user to trigger a kernel WARNING and cause system instability via the ccs_mode sysfs attribute. When ccs_mode_store() invokes xe_gt_reset() without first acquiring an outer runtime PM reference, the internal xe_pm_runtime_get_noresume() call detects the unprotected state and emits a kernel WARNING, with potential for device reset failures and availability loss. No public exploit code exists and EPSS is 0.02%, consistent with a driver correctness bug rather than a targeted security vulnerability; patches are available in stable kernel trees.
Denial of service in Linux kernel x86/platform/uv module when sockets are deconfigured, causing kernel panic during UV hub info structure allocation on systems with SGI UV architecture. Affects authenticated local attackers with standard user privileges. Vendor-released patches available for multiple kernel versions (6.6.130, 6.12.78, 6.18.20, 6.19.10 and others). EPSS score of 0.02% indicates exploitation is unlikely in typical environments despite low CVSS score barrier.
Memory leak in the Linux kernel's DAMON (Data Access MONitor) sysfs subsystem allows a local low-privileged user to exhaust kernel memory by triggering a race condition between process termination and damon_call() invocation. When DAMON is configured to monitor virtual address spaces and the target process exits before damon_call() executes, the dynamically allocated repeat_call_control structure is never freed. No public exploit exists and EPSS is 0.02% (4th percentile), placing this firmly in the low-urgency tier despite the high availability impact scored by CVSS.
Memory exhaustion in the Linux kernel's rxrpc/rxgk subsystem allows a local low-privileged attacker to cause a denial-of-service condition by triggering a resource leak in rxgk_verify_response(), where allocated rxgk authentication context objects are never released. The flaw is confined to systems actively using AFS with RxGK GSS-based authentication, a non-default configuration absent from the vast majority of Linux deployments. No public exploit code exists and exploitation probability is extremely low (EPSS 0.02%), though patched stable kernel versions 6.18.23, 6.19.13, and 7.0 are available.
Kernel crash (oops) in the Linux PCI endpoint virtual NTB (pci-epf-vntb) driver allows a local user with limited privileges to trigger a use-after-free via configfs symlink operations. The driver's epf_ntb_epc_destroy() helper performs resource teardown that duplicates what the caller later executes, causing a double-free that dereferences a kernel poison pointer (0xDEAD000000000108) and crashes the system. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.02% (4th percentile), and impact is purely availability - confidentiality and integrity are not affected.
Null pointer dereference in the Linux kernel's KVM SEV subsystem crashes the host with a kernel panic when a low-privileged local user issues a specific ioctl sequence. The missing `kvm->lock` acquisition before the `sev_guest()` check in `sev_mem_enc_register_region()` allows exploitation when `KVM_SEV_INIT{2}` fails and leaves `sev->regions_list` uninitialized - a subsequent `KVM_MEM_ENCRYPT_REG_REGION` ioctl then dereferences the null list head. No confirmed active exploitation (not in CISA KEV), but a syzbot-generated reproducer is embedded in the CVE description; EPSS is 0.02% (4th percentile), consistent with the local-only, denial-of-service nature. Patched kernel versions 6.18.24, 6.19.14, and 7.0.1 are available.
Kernel crash risk in Linux KVM's AMD SEV-SNP guest launch path allows a local attacker with KVM vCPU management privileges to crash the host by exploiting a missing vCPU lock during VMSA synchronization. The SEV-SNP `KVM_SNP_LAUNCH_FINISH` path failed to lock all vCPUs before encrypting their save areas, permitting concurrent userspace manipulation that corrupts per-vCPU state or triggers a kernel panic. No public exploit code has been identified and the EPSS score of 0.02% (4th percentile) reflects extremely low exploitation probability, making this a targeted concern for AMD EPYC-based KVM hypervisors running SNP guests.
Deadlock in the Linux kernel WireGuard subsystem can cause a hung task and system-level denial of service for authenticated local users. The `wg_netns_pre_exit()` pernet callback manually acquires `rtnl_lock()`, blocking indefinitely if `rtnl_mutex` is concurrently held by the `cleanup_net` workqueue or `setup_net` failure rollback path. No public exploit exists and EPSS is extremely low (0.02%, 4th percentile); however, the issue spans a broad range of kernel versions and has been patched in stable releases 6.18.24, 6.19.14, and 7.0.1.
Race condition in the Linux kernel's userfaultfd hugetlb path allows a local low-privilege user to crash the kernel by triggering a BUG_ON assertion in resv_map_release(). The root cause is a unit mismatch in mfill_atomic_hugetlb(): linear_page_index() returns a PAGE_SIZE-unit index while hugetlb_fault_mutex_hash() expects a huge-page-granularity index, causing concurrent fault threads within the same huge page to acquire different mutexes and corrupt the reservation map. No public exploit has been identified and EPSS is 0.02% (4th percentile), placing real-world risk firmly in the low tier despite reliable kernel crash reproducibility under the right conditions.
State ordering regression in the Linux kernel's drm/i915 Intel graphics driver causes unlink_nv12_plane() to clobber plane state already computed by plane_atomic_check(), resulting in a kernel WARN and availability disruption on systems with Intel i915 GPUs. The flaw affects local users with DRM device access who configure a plane previously used as an NV12 Y plane back to a normal plane. No public exploit exists and EPSS sits at 0.02% (4th percentile), confirming this as a low-probability exploitation scenario; however, the patch is available across multiple stable kernel branches.
Spurious WARN_ON() in the Linux kernel's PM sleep subsystem (pm_restore_gfp_mask()) can be triggered by defensive hibernation code paths, causing kernel warning floods or, on systems with panic_on_warn=1, a full kernel panic and denial of service. Affected kernels contain commit 35e4a69b2003f introducing refcount-based GFP mask stacking but lack the corrective fix removing the assertion from the zero-count guard. No active exploitation confirmed (not in CISA KEV), and EPSS is 0.02% (4th percentile), consistent with a low-risk code-quality defect rather than a targeted vulnerability.
NULL pointer dereference in the Linux kernel's MediaTek DSI DRM driver causes a kernel panic during module initialization on ARM64 systems with MediaTek display hardware. The crash occurs because `mipi_dsi_host_register` triggers the `mtk_dsi_bind` callback before the `mtk_dsi` struct is stored in driver data, dereferencing a NULL pointer inside `drm_mode_object_add` and acquiring `mode_config.idr_mutex` before panicking - blocking all subsequent DRM operations on the system. No public exploit exists and EPSS stands at 0.02%, consistent with a hardware-specific local denial-of-service with no confidentiality or integrity impact.
A NULL pointer dereference in the Linux kernel ARM SCMI firmware driver allows local authenticated users to trigger a denial of service by causing the system to crash. The vulnerability exists in the __scmi_event_handler_get_ops helper function, which can return NULL instead of the expected ERR_PTR on failure, causing downstream code to dereference a NULL pointer when handling unsupported SCMI events. The flaw was introduced in commit b5daf93b809d1 and affects multiple stable kernel versions; patches are available in Linux 6.18.20, 6.19.10, and 7.0.
Debug logging in the Linux kernel's crash_dump module exposes dm-crypt key material when debug logging is enabled, allowing local privileged users to read encryption keys from kernel logs and potentially cause denial of service through availability impact on crash dump functionality. The vulnerability affects Linux kernel versions prior to 6.18.20, 6.19.10, and 7.0, with an EPSS score of 0.02% indicating low exploitation probability despite the information disclosure risk.
Denial of service in Linux kernel SMB server implementation allows local authenticated users to crash the system by triggering data stream corruption through improper credit management in smbdirect socket operations. The vulnerability affects kernel versions prior to 6.18.11, 6.19.1, and 7.0, and requires local access with limited privileges to exploit.
Stored DOM-level XSS in AnythingLLM's chart caption rendering allows authenticated users in shared workspaces to inject malicious markdown via indirect prompt injection, affecting all other users who view the compromised conversation. The vulnerability stems from unsafe markdown-to-HTML conversion in the Chartable component that bypasses the application's standard DOMPurify sanitization defense-in-depth. Versions prior to 1.12.1 are affected; patch available.
Lightspeed Classroom v5.1.2.1763770643 contains a client-side authorization flaw that allows unauthenticated remote attackers to impersonate users and bypass integrity checks on client-generated authorization tokens, enabling unauthorized remote control and monitoring of student devices. The vulnerability requires high attack complexity and affects confidentiality and integrity with limited scope impact (CVSS 5.4). Despite a high CVSS score, the EPSS score of 0.03% indicates minimal real-world exploitation probability, suggesting this requires specific technical conditions or targeted attack scenarios rather than widespread automated exploitation.
Axios HTTP client versions prior to 1.15.1 and 0.31.1 use loose truthy/falsy comparison instead of strict boolean checks for the withXSRFToken config property, allowing XSRF tokens to be sent to cross-origin servers when the property is set to any truthy non-boolean value through prototype pollution or misconfiguration. This bypasses same-origin validation and enables attackers to exfiltrate XSRF tokens to attacker-controlled domains, compromising CSRF protection across applications using vulnerable versions.
Cross-site request forgery (CSRF) in Authlib's Starlette OAuth client cache feature (versions prior to 1.6.11) allows unauthenticated remote attackers to forge requests that manipulate cached OAuth state, potentially leading to session hijacking or token theft. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity. Vendor-released patch: version 1.6.11.
Axios HTTP client versions 1.0.0 through 1.15.0 allow header injection in multipart form-data bodies through unsanitized CRLF sequences in the Content-Type header of individual parts. An attacker controlling a Blob/File object's .type property (such as via user-uploaded files in a Node.js proxy service) can inject arbitrary MIME headers into the multipart body, bypassing Node.js v18+ built-in header protections. The vulnerability affects network-accessible services and results in integrity compromise through header manipulation.
Axios HTTP client prior to version 1.15.1 (1.x branch) and 0.31.1 (0.x branch) fails to enforce maxContentLength limits when responseType is set to 'stream', allowing attackers to cause denial of service by streaming unbounded response payloads that bypass configured size restrictions. The vulnerability affects both browser and Node.js environments and requires no authentication or user interaction to exploit.
Axios versions prior to 1.15.1 and 0.31.1 allow remote attackers to bypass maxBodyLength restrictions on stream request bodies when maxRedirects is set to 0, enabling denial of service through oversized uploads that consume unbounded server resources. The vulnerability affects the native http/https transport path in Node.js environments and enables attackers to send streamed payloads that exceed configured size limits, potentially exhausting memory or bandwidth on the target application.
MaxiBlocks Builder plugin for WordPress up to version 2.1.8 allows authenticated attackers with Author-level access to delete arbitrary files in the wp-content/uploads directory via the 'maxi_remove_custom_image_size' AJAX action due to insufficient file ownership validation. This enables deletion of media uploaded by other users and administrators without proper authorization checks, violating file integrity despite the CVSS 5.3 score reflecting limited direct impact.
ExactMetrics Google Analytics Dashboard for WordPress versions up to 9.1.2 allow authenticated subscribers to retrieve Google Ads access tokens and reset Google Ads integration settings through missing authorization checks in AJAX handlers. Although a nonce is verified, two AJAX endpoints (get_ads_access_token and reset_experience) lack the capability checks present in similar endpoints, enabling attackers with subscriber-level access to perform administrative actions. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects network-accessible unauthenticated exploitation, but the description indicates authenticated subscriber access is required, creating a discrepancy between reported CVSS and actual attack prerequisites.
4ga Boards prior to version 3.3.5 leaks valid usernames and email addresses through response timing analysis on the login endpoint. An unauthenticated attacker can distinguish between invalid credentials (where the username/email does not exist) and valid credentials with an incorrect password by measuring response times, with a ~4.4× timing difference detectable in a single request over the network. This enables user enumeration attacks without brute-force constraints, allowing reconnaissance for subsequent account takeover attempts.