Refcount leak in the Linux kernel's fbdev Open Firmware display timing subsystem (of_get_display_timings()) affects kernel versions from 3.9 through multiple stable branches, allowing a local low-privileged user to trigger resource exhaustion that degrades system availability. The flaw lies in error-path handling where of_parse_phandle() increments a device_node refcount into native_mode, but the goto target 'entryfail' at lines 184 and 192 never calls of_node_put(native_mode), leaving the refcount permanently elevated. No active exploitation has been identified - EPSS of 0.02% (7th percentile) and absence from CISA KEV confirm this as a maintenance-class kernel fix rather than an emergency threat.
Recursive glock deadlock in the Linux kernel GFS2 cluster filesystem driver allows a locally authenticated user to cause a kernel thread hang and denial of service. In gfs2_fiemap(), the inode glock is held while calling iomap_fiemap(); if the userspace fiemap output buffer is memory-mapped to the same GFS2 inode, a page fault during buffer writes triggers a second attempt to acquire the already-held glock, producing a deadlock. No public exploit or CISA KEV listing exists; EPSS is 0.02% (7th percentile), consistent with the niche GFS2 deployment footprint and the specific trigger conditions required.
Spectre-BHB (Branch History Buffer) software mitigation was absent in the Linux kernel arm64 subsystem for systems running the HiSilicon TSV110 processor, leaving those systems exposed to branch prediction side-channel attacks capable of leaking sensitive kernel memory contents across privilege boundaries. The root cause was the kernel lacking the TSV110 MIDR (Main ID Register) entry in its processor-specific mitigation table, meaning the software workaround was never applied on that hardware. No public exploit has been identified at time of analysis, and EPSS probability sits at a low 0.02% (7th percentile), though the real-world confidentiality risk on Huawei/HiSilicon arm64 deployments is meaningful given the class of attack.
Denial of service in Linux kernel media cx88 driver allows local authenticated attackers to exhaust system resources by triggering a missing DMA unmapping in the snd_cx88_hw_params() error path. The vulnerability causes resource leaks when audio hardware parameter initialization fails, potentially rendering the audio subsystem unavailable. CVSS 5.5 reflects local attack vector with low complexity; EPSS 0.02% indicates minimal real-world exploitation probability despite vendor-released patches across multiple kernel versions.
A use-after-free condition in the libertas USB wireless driver allows local attackers with user privileges to cause a denial of service by triggering a kernel warning and potential crash through rapid firmware loading or repeated usb_tx_block() calls while a USB request is still active. The vulnerability stems from insufficient synchronization of USB URB submissions, enabling concurrent requests on the same URB without enforcing completion of prior transmissions.
NULL pointer dereference in the Linux kernel HID prodikeys driver allows a local attacker with USB access to crash the kernel by presenting a crafted USB device that impersonates a Creative Prodikeys PC-MIDI controller. When the fake device's HID report descriptors bypass the input_mapping() callback, pm->input_ep82 remains NULL; subsequent dereference of that pointer causes a kernel panic, resulting in a complete availability loss. No public exploit or active exploitation has been identified; EPSS is 0.02% (7th percentile), consistent with the local-only, denial-of-service-only impact profile.
Memory leak in the tw9906 media driver's probe function allows local authenticated attackers to cause denial of service through memory exhaustion. The vulnerability occurs in tw9906_probe() when an error path fails to free memory allocated by v4l2_ctrl_handler_init() and v4l2_ctrl_new_std(), potentially leading to kernel memory depletion on repeated device probe attempts. Vendor-released patches are available across multiple stable kernel branches.
Memory leak in the Linux kernel's TI K3 SoC info driver (soc/ti/k3-socinfo) fails to release an allocated mmio regmap, causing denial of service through resource exhaustion on probe failures and driver unbind. Local attackers with low privileges can trigger probe deferral or driver unbind to exhaust kernel memory, affecting systems running vulnerable Linux kernel versions. The vulnerability has a low EPSS score (0.02%) but enables practical local DoS against systems where low-privilege users can control driver lifecycle.
Linux kernel x86 architecture fails to validate IMA measurement list memory bounds during kexec boot with restricted memory parameters, causing kernel panic when the carried-over IMA buffer falls outside truncated RAM. Authenticated local users with kexec privileges can trigger a denial of service. The fix adds a sanity check to validate the previous kernel's IMA kexec buffer against actual memory bounds before restoration, aligning x86 behavior with other architectures.
Divide-by-zero in the Linux kernel's traffic control subsystem (`net/sched/act_skbedit.c`) crashes the kernel when a tc SKBEDIT action is configured with a queue mapping range spanning the full u16 address space. Affected kernels range from 5.19 (where commit 38a6f0865796 introduced SKBEDIT_F_TXQ_SKBHASH support) through all unpatched stable branches up to 7.0; vendor-released patches are available across six stable branches. No public exploit code exists and EPSS sits at 0.02% (7th percentile), making this a low-urgency patch cycle item for most environments, with highest relevance where low-privileged users can invoke tc configuration.
Memory leak in the Linux kernel's radio-keene USB FM transmitter driver (radio-keene.c) leaves a v4l2 control handler unfreed when either v4l2_device_register() or video_register_device() fails during device probe. Affected kernel versions range from the commit introducing the flaw (1bf20c3a0c616f44359c573b533d06bae960ee45) through multiple stable branches, with fixed versions confirmed across 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, and 7.0. No public exploit has been identified at time of analysis, and EPSS at 0.02% (7th percentile) confirms negligible real-world exploitation probability.
Denial-of-service through an invalid spinlock context in the Linux kernel's sh_tmu (SH Timer Unit) clocksource/clockevent driver triggers a lockdep violation and system hang on PREEMPT_RT-enabled builds running on Renesas SH/ARM platforms. The driver invokes pm_runtime_*() and clk_*() functions while holding a raw spinlock required by the clockevent framework; on PREEMPT_RT kernels, these PM and clock management calls acquire regular spinlocks that can sleep, making the combined locking sequence illegal. No public exploit code exists and exploitation probability is negligible (EPSS 0.02%), but the impact on affected hardware is a full system availability loss. Patches are confirmed available across all active stable branches.
Memory leak in the Linux kernel's staging rtl8723bs Wi-Fi driver degrades system availability for hosts running affected kernel versions with Realtek RTL8723BS hardware. The flaw occurs in the BSS scanning code path where cfg80211_inform_bss_frame() can return NULL on failure, but the previously allocated 'buf' buffer is not released, causing unbounded kernel memory loss over time. With EPSS at 0.02% (7th percentile), no CISA KEV listing, and no public exploit code, this is a low-urgency memory management defect patched across all active stable kernel branches.
URB (USB Request Block) leak in the Linux kernel pvrusb2 media driver causes a denial-of-service condition on systems with Hauppauge WinTV-PVR USB2 capture devices. The pvr2_send_request_ex() function fails to unlink and await the write URB before returning on read URB submission failure, leaving the URB in an active state; subsequent driver calls trigger a 'URB submitted while active' kernel warning that destabilizes the USB subsystem. No public exploit exists and EPSS is 0.02% (7th percentile), but vendor-released patches are available across all major stable kernel branches.
Uninitialized read bytes in the Linux kernel IPMI IPMB driver expose systems to a local denial-of-service condition. The IPMB subsystem does not use i2c reads by design, but when an i2c read is triggered through the event handler, an uninitialized value is returned from the underlying bus driver, potentially causing kernel instability or a crash on affected server hardware. No public exploit exists and EPSS is 0.02% (7th percentile), indicating low real-world exploitation probability despite patches being available across multiple stable branches.
Memory leak in Linux kernel tw9903 media driver probe function allows local authenticated attackers to cause denial of service through repeated device initialization failures. The v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() allocations are not freed in one error path of tw9903_probe(), enabling exhaustion of kernel memory. CVSS 5.5 (local, low complexity, requires low privileges). EPSS score of 0.02% indicates minimal exploitation probability.
Denial of service in Linux kernel minix filesystem implementation allows local authenticated users to crash the system via crafted minix superblock structures due to missing validation of s_log_zone_size and other superblock fields in the minix_check_superblock() function.
Memory leak in Linux kernel fbdev vt8500lcdfb driver allows local authenticated users to cause denial of service via unfreed DMA-allocated buffer on error path. The vulnerability exists in the framebuffer initialization code where dma_alloc_coherent() allocation for fbi->fb.screen_buffer is not properly freed if an error occurs during probe, leading to memory exhaustion on repeated device initialization attempts. Local privilege required; no remote or unauthenticated attack vector.
Denial of service in Linux kernel PCI endpoint configfs interface allows local attackers with low privileges to crash the kernel via swapped parameters in pci_primary_epc_epf_unlink() and pci_secondary_epc_epf_unlink() functions. When executing the unlink command in configfs, incorrect parameter ordering causes invalid memory access and kernel panic. CVSS 5.5 (local, low complexity, low privilege) with EPSS 0.02% suggests limited real-world exploitation despite confirmed availability of patches across multiple kernel branches.
Resource leak in the Linux kernel cx25821 media driver allows a local low-privileged user on a system with CX25821 video capture hardware to degrade system availability by exhausting kernel I/O memory regions. The flaw exists in cx25821_dev_setup() where a call to release_mem_region() is missing on the ioremap() failure path, leaving a memory region claimed by cx25821_get_resources() permanently unreleased. No public exploit code exists and EPSS sits at 0.02% (7th percentile), confirming this as a low-exploitation-risk maintenance fix rather than an active threat; patches are available across all active stable kernel branches.
Division by zero in the Linux kernel's CCS (Camera Control Set) media driver can be triggered by a local authenticated user, causing a kernel crash and denial of service. The flaw exists in scaler configuration logic where the MAX_M calculation divides by the MIN_X_OUTPUT_SIZE limit register value without first validating it is non-zero. Affected systems must have a CCS-compatible camera device attached and the ccs media driver loaded; no public exploit or active exploitation (CISA KEV) has been identified, and EPSS sits at 0.02%, reflecting very low real-world exploitation probability.
NULL pointer dereference in the Linux kernel's ixp4xx Ethernet driver (net/ethernet/xscale) crashes the kernel on Intel IXP4xx-based embedded systems when PTP timestamp queries are made against non-ixp46x hardware. A local authenticated user on affected hardware can trigger a kernel panic simply by running standard tools such as tcpdump or ethtool, causing a full system crash. No active exploitation is confirmed (EPSS 0.02%, no CISA KEV listing), and real-world impact is constrained to legacy IXP4xx-based embedded devices such as OpenWrt-capable routers.
Integer underflow in the Linux kernel's EFI/CPER firmware error logging function (cper_print_fw_err) allows local authenticated attackers to trigger denial of service via memory dump of unmapped regions, disclose kernel memory contents, or cause system crash when processing malformed EFI firmware error records with invalid offsets. The vulnerability stems from insufficient validation of error record length before subtracting an offset, causing integer wraparound that permits dumping of arbitrary kernel memory regions.
Denial of service via incomplete xattr cleanup in the Linux kernel OCFS2 filesystem causes memory corruption when processing reflinked files with extended attributes. A local user with standard privileges can trigger this vulnerability through crafted xattr operations, resulting in system crashes or data integrity issues. The flaw affects Linux kernel versions from 2.6.32 through multiple recent releases (5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 6.19), with vendor-released patches available for supported stable branches.
Memory leak in the Linux kernel's tegra-video media driver causes local denial-of-service on NVIDIA Tegra-based systems. The `__tegra_channel_try_format()` function fails to free a V4L2 subdev state object on two error paths after `v4l2_subdev_call()` fails, leaking kernel memory on each invocation. A local authenticated attacker with access to a Tegra video capture device can repeatedly trigger the error paths to exhaust kernel memory, degrading or crashing the system. No public exploit exists and EPSS is 0.02% (7th percentile), consistent with a niche, hardware-specific availability issue.
Null pointer dereference in the Linux kernel's rtl8723bs staging Wi-Fi driver allows a locally authenticated user to crash the kernel, resulting in a denial of service. The `pwlan` variable in `find_network()` is not validated for NULL before being passed to `rtw_free_network_nolock()`, which then dereferences it unconditionally. The flaw has been present since Linux 4.12 and is patched across all active stable branches; no public exploit exists and EPSS sits at 0.02%, confirming negligible exploitation activity.
Memory leak in the Linux kernel's octeontx2-af CGX driver causes kernel resource exhaustion on systems using Marvell OcteonTX2 network hardware. The rx_fc_pfvf_bmap and tx_fc_pfvf_bmap bitmaps allocated during cgx_lmac_init() are never freed in cgx_lmac_exit(), meaning each unbind/rebind cycle of the driver leaks 16 bytes of kernel memory, detectable via kmemleak. No public exploit is identified at time of analysis, and with an EPSS of 0.02% (7th percentile), real-world exploitation risk is negligible; this is a correctness and stability issue rather than an active security threat.
Denial-of-service in the Linux kernel's pegasus USB-to-Ethernet driver allows a local attacker to crash the kernel by connecting a crafted USB device with mismatched endpoint transfer types. The driver's probe function fills URBs using hardcoded endpoint pipes (bulk RX on ep1, bulk TX on ep2, interrupt on ep3) without first verifying the endpoint descriptors presented by the attached device, leaving it susceptible to assertion failure when types do not match expectations. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.02% reflects the niche local-access-only attack surface; patches have been released across all major stable kernel branches.
NULL pointer dereference in the Linux kernel's hid-pl driver (Pantherlord/GreenAsia USB game controllers) allows a local low-privileged user to crash the kernel by triggering force feedback on an improperly initialized device. The root cause is unhandled probe errors during driver initialization that leave NULL pointers in place of valid data structures, which are later dereferenced when force feedback is first invoked. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.02% at the 7th percentile reflects negligible real-world exploitation probability.
Incorrect DMA buffer cleanup in the Linux kernel's fsl_ucc_hdlc WAN driver (used on Freescale/NXP QorIQ embedded platforms) causes a double-free of coherent DMA memory, resulting in a kernel panic and system crash. The driver allocates rx_buffer and tx_buffer as a single contiguous DMA region in uhdlc_init() but mistakenly calls dma_free_coherent() twice - once per buffer pointer - in uhdlc_memclean(), corrupting the DMA allocator state. Any authenticated local user or kernel path that triggers interface teardown on affected hardware can cause a complete availability loss. No public exploit identified at time of analysis, and EPSS at 0.02% (7th percentile) reflects near-zero opportunistic exploitation probability given the narrow hardware scope.
NULL pointer dereference in the Linux kernel's powerpc/smp subsystem allows a local authenticated user to crash the kernel, causing a denial of service on PowerPC-based systems. The `parse_thread_groups()` function passes the return value of `kcalloc()` directly to `of_property_read_u32_array()` without validating it for NULL, meaning a failed memory allocation - possible under memory pressure - leads to a kernel panic or oops. No public exploit code exists and this vulnerability is not in CISA KEV; with an EPSS of 0.02% (7th percentile) and architecture-specific scope limited to PowerPC, real-world exploitation risk is low but relevant to IBM POWER server deployments running Red Hat or SUSE Linux.
Deadlock in the Linux Kernel PCI/IOV SR-IOV subsystem allows a local low-privileged user to trigger a kernel hang via a recursive mutex acquisition, resulting in a complete denial of service on the affected host. The root cause is commit 05703271c3cd, which added pci_rescan_remove_lock around SR-IOV enable/disable operations without accounting for the re-entrant path where sriov_del_vfs() is invoked from within pci_stop_and_remove_bus_device_locked(), which already holds the same lock. No public exploit has been identified at time of analysis, and EPSS probability is negligible at 0.02%, consistent with the local-only attack vector.
Kernel crash in the Linux remoteproc imx_rproc subsystem (NXP i.MX platform) allows a local authenticated attacker to trigger a denial of service by loading firmware that lacks a resource table. The root cause is imx_rproc_elf_find_loaded_rsc_table() returning a stale non-NULL priv->rsc_table pointer even when rproc->table_ptr is NULL, causing the remoteproc core to dereference what it incorrectly treats as a valid loaded resource table. No public exploit has been identified at time of analysis, and EPSS at 0.02% (7th percentile) reflects the narrow hardware-specific attack surface.
Missing mutex locking around the `mfd_of_node_list` linked list in the Linux kernel's Multi-Function Device (MFD) core subsystem allows a local low-privileged attacker to trigger a race condition, resulting in a kernel crash and denial of service. The vulnerability spans multiple stable kernel branches from the introducing commit 466a62d7642f through patched releases in 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, and 7.0. No public exploit exists and the EPSS score of 0.02% (7th percentile) reflects negligible community exploitation interest; this is not listed in CISA KEV.
NULL pointer dereference in the Linux kernel's HID magicmouse driver allows a local attacker with low privileges to crash the kernel by connecting a crafted USB device that impersonates an Apple Magic Mouse. When a fake USB device provides a custom report descriptor, the input_mapping() hook is never called, leaving msc->input as NULL; subsequent access in input_configured() causes a kernel panic and complete availability loss. No public exploit exists and EPSS is negligible at 0.02% (7th percentile), but the impact is a full system denial of service when exploitation conditions are met.
Kernel denial-of-service via crafted USB HID descriptor in the Linux logitech-hidpp driver allows an attacker controlling a USB gadget device to crash the kernel by presenting a report descriptor with zero fields. The missing maxfield bounds check in hidpp_get_report_length() causes the kernel to dereference invalid memory when the hid-logitech-hidpp module processes the malformed descriptor. No active exploitation confirmed (not in CISA KEV), and EPSS at 0.02% (7th percentile) reflects very low real-world exploitation probability despite the broad Linux kernel footprint.
Resource leak in the Linux kernel cx23885 media driver's ALSA interface causes local denial of service on systems with Conexant 23885 PCI TV tuner hardware. The `snd_cx23885_hw_params()` function fails to call `cx23885_alsa_dma_unmap()` in its error path, leaving DMA resources allocated by `cx23885_alsa_dma_map()` unreleased. A low-privileged local attacker on an affected system can repeatedly trigger the error path to exhaust DMA resources, crashing the kernel subsystem. No public exploit exists and EPSS is 0.02% (7th percentile), reflecting extremely low real-world exploitation probability.
Denial of service in Linux kernel dm-verity subsystem allows local authenticated users to crash the system by triggering dm_bufio_client_create() failure in verity_fec_ctr(), which incorrectly passes an error pointer to dm_bufio_client_destroy(). The vulnerability requires local access and authenticated privileges but no user interaction, affecting dm-verity configurations with forward error correction enabled.
Hard-lockup in Linux kernel IOMMU/VT-d subsystem when flushing device IOTLB during PCIe link-down events affects systems using scalable mode with PASID support. Local authenticated attackers can trigger denial of service by causing PCIe device disconnection followed by resource cleanup operations, such as releasing VFIO group file descriptors, which deadlock the system while attempting ATS invalidation on inaccessible devices. Patch available across multiple stable kernel series.
Denial of service via null pointer dereference in Linux kernel's pstore persistent storage subsystem occurs when the vmap() function fails but the persistent_ram_vmap() function incorrectly returns success if a non-zero offset is present, allowing subsequent buffer access to dereference invalid memory and cause system crashes. Affects Linux kernel versions prior to 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, and 7.0. No public exploit identified at time of analysis, but vendor-released patches are available across multiple stable branches.
NULL pointer dereference in the Linux kernel framebuffer console (fbcon) subsystem allows a local low-privilege user to crash the system. The function con2fb_acquire_newinfo() fails to check the return value of fbcon_open(); when fbcon_open() fails, info->fbcon_par remains NULL and is subsequently dereferenced, triggering a kernel panic. Patches are available across all active stable branches (5.15.x through 7.0), EPSS is 0.02% at the 7th percentile, and no confirmed active exploitation is recorded in CISA KEV.
Local denial-of-service in the Linux kernel's AEAD crypto socket interface (`algif_aead`) allows a low-privileged local user to crash the kernel by submitting a decryption request where the minimum receive buffer size check fails to account for the authentication tag length. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms this is a locally exploitable, high-availability-impact issue with no confidentiality or integrity risk. Patches have been released across multiple Linux LTS stable branches (5.10.254, 5.15.204, 6.1.170, 6.6.136, 6.12.83, 6.18.24, 6.19.14, 7.0) and Ubuntu has issued multiple USN advisories (USN-8277-1 through USN-8281-1). No public exploit code has been identified and EPSS is 0.02%, indicating no public exploitation activity.
Resource reference leak in the Linux kernel's dm-multipath (dm mpath) subsystem allows a local low-privileged user to trigger an availability impact against systems using multipath SCSI storage. Specifically, the `parse_path()` function fails to call `dm_put_device()` when `scsi_dh_attached_handler_name()` returns -ENOMEM during path parsing, leaving a dangling device reference that is never released. No public exploit exists and EPSS probability is 0.02%, placing this firmly in the low-exploitation-likelihood tier, but enterprise Linux systems with SAN-backed multipath storage are in scope. Vendor-released patches are available in Linux 6.19.6 and the 7.0 stable branch.
Null pointer dereference in the AMD GPU (amdgpu) DRM subsystem can cause denial of service when the SDMA block is disabled and buffer_funcs initialization is skipped, allowing local authenticated users to crash the kernel via uninitialized function pointer access.
Silent error suppression in the Linux kernel's NTFS3 filesystem driver allows a local authenticated user to trigger inode inconsistency by causing attr_set_size() to fail during file truncation. Affected systems running NTFS3-mounted volumes may experience filesystem corruption or denial of service without any visible error signal to the kernel. No active exploitation has been identified (EPSS 0.02%, not in CISA KEV), and vendor-released patches are available in Linux 7.0 and 6.19.6.
Memory allocation underflow in the Linux kernel ASoC SOF (Sound Open Firmware) ipc4-topology module allows local authenticated users to trigger a denial of service via bytes control handling that fails to account for the full data structure size. The vulnerability affects kernel versions prior to specific stable releases (6.6.128, 6.12.75, 6.18.16, 6.19.6, and 7.0) where the allocation size calculation omits the sof_ipc4_control_data structure, potentially causing memory exhaustion or kernel crash when processing audio topology configuration.
NULL pointer dereference in the Linux kernel md-cluster subsystem allows a local low-privileged user to crash the system during a narrow race window in MD array startup. The process_metadata_update() function blindly dereferences mddev->thread before it is initialized, which becomes reachable if a remote cluster peer sends a METADATA_UPDATED message after bitmap_load() starts the recv_daemon but before mddev->thread is assigned in md_run(). No public exploit has been identified at time of analysis, and EPSS probability is 0.02% (5th percentile), consistent with a niche, timing-dependent local DoS.
Denial of service in Linux kernel KCM (kernel connection multiplexer) subsystem when processing messages with zero-fragment skbs in frag_list after partial sendmsg failures. A local authenticated attacker can trigger a kernel warning and potentially crash the system by sending a malformed message that fails during data copy, leaving an empty skb in the fragment list. The vulnerability requires local access and low-level socket manipulation, affecting systems running vulnerable Linux kernel versions prior to patching.
A denial of service vulnerability in the Linux kernel's AMD display driver (drm/amd/display) allows local authenticated users to crash the system by accessing link encoder functionality on DisplayPort over USB-C (DPIA) links without proper signal type validation. The vulnerability affects kernel versions before the patches released in stable branches 6.12.75, 6.18.16, 6.19.6, and 7.0. No public exploit code has been identified, and real-world exploitation probability is very low (EPSS 0.02%), suggesting this is primarily an edge-case denial of service affecting specific hardware configurations with DPIA displays.
Kernel panic in the Linux kernel's chips-media wave5 VPU driver stems from an incorrect device cleanup order during module removal or autosuspend, allowing a powered-down hardware state to be accessed by a still-running worker thread. Systems with chips-media wave5 VPU hardware running video encoding workloads are vulnerable to a local denial-of-service via synchronous external abort (bus error). No public exploit exists and no active exploitation is confirmed; EPSS is 0.02% (5th percentile), reflecting the niche hardware requirement.