Memory leak in the Linux kernel io_uring zero-copy receive (zcrx) subsystem allows a local low-privileged attacker to exhaust kernel memory via repeated DMA mapping failures on PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA systems, causing denial of service. The root cause is a sgtable (scatter-gather table) resource that is initialized but never freed when io_populate_area_dma() fails, because the error path's cleanup guard (!is_mapped) incorrectly skips deallocation. No public exploit exists and EPSS is 0.02% (4th percentile), reflecting the narrow hardware-specific trigger condition.
Denial of service in the Linux kernel AMD IOMMU subsystem allows a local low-privileged user to crash or stall IOMMU completion waits on systems with AMD hardware and IOMMU enabled. The root cause is a race condition where cmd_sem_val was incremented outside the IOMMU spinlock, permitting CMD_COMPL_WAIT commands to queue out of order and breaking the ordering invariant in wait_on_sem() under concurrent TLB invalidations. No public exploit or active exploitation has been identified; EPSS stands at 0.02% (4th percentile), reflecting negligible real-world exploitation probability at time of analysis.
Improper error-path cleanup in the Linux kernel's cpsw_new (TI Common Platform Switch) network driver can trigger an attempt to unregister a net device that was never successfully registered, causing a kernel crash or panic and resulting in local denial of service. Systems running affected kernel versions on Texas Instruments SoC hardware - including BeagleBone and AM335x/AM437x platforms - are at risk when the CPSW driver encounters a failure during the first MAC's netdev registration. No public exploit identified at time of analysis and EPSS exploitation probability is extremely low at 0.02% (4th percentile), consistent with its hardware-specific, error-path nature.
Kernel panic in the Linux iris gen2 media driver can be triggered by a local low-privileged user when a sequencing flaw between iris_kill_session and stop_streaming causes a NULL dereference of a freed packet buffer. The iris driver - used for Qualcomm video codec hardware - frees inst_hfi_gen2->packet during session teardown via kfree, but stop_streaming lacks a guard against subsequently dereferencing that pointer when sending a STOP command to firmware, resulting in a system crash. No public exploit code exists, EPSS is 0.02% (4th percentile), and vendor-released patches are confirmed across multiple stable kernel branches.
Denial of service in the Linux kernel's net subsystem via deadlock in skb_may_tx_timestamp() when socket timestamp completion occurs in interrupt context while sk_callback_lock is write-locked, affecting local attackers with user privileges on systems with network drivers that complete TX timestamps from dedicated interrupt handlers.
Missing input validation in the Linux kernel's amdgpu DRM driver allows a local user with low privileges to trigger GPU faults by supplying invalid user queue sizes. The driver fails to enforce two hardware requirements - that queue sizes be a power-of-two and at least AMDGPU_GPU_PAGE_SIZE - enabling crafted queue configurations that cause availability loss (GPU faults or unexpected GPU subsystem behavior). No public exploit is identified at time of analysis, and EPSS at 0.02% (4th percentile) reflects very low real-world exploitation probability. Patches are available in kernel stable branches 6.18.16, 6.19.6, and 7.0.
Kernel worker crash (BUG_ON oops) in the Linux kernel Ceph filesystem driver occurs when fscrypt encryption is enabled and GFP_NOWAIT bounce buffer allocations fail during writeback batch processing. A local user with write access to an fscrypt-encrypted Ceph mount can trigger this under memory pressure, causing the writeback loop to pass a stale page array pointer to ceph_allocate_page_array(), firing its BUG_ON assertion and crashing the worker. No public exploit is identified; EPSS of 0.02% (4th percentile) and absence from CISA KEV confirm negligible real-world exploitation activity.
GPIO sysfs teardown in the Linux kernel fails to drop the final sysfs attribute reference when a GPIO controller is unbound while pins remain exported, leaving stale /sys/class/gpio entries and causing a kernel availability impact on affected systems. Kernels from commit 1cd53df733c21ae0d344a2dec941a3e2a06fefd9 through the fix are affected, with patched stable releases at 6.18.16, 6.19.6, and 7.0; Red Hat and SUSE downstream kernels incorporating the affected range are similarly impacted. No public exploit exists and the EPSS score is 0.02% (4th percentile), making this primarily a stability concern for embedded Linux deployments actively using the GPIO sysfs interface.
EROFS filesystem folio reference leaks in the Linux kernel allow a local low-privileged attacker to cause availability degradation by mounting crafted EROFS images with metabox (metadata compression) enabled, triggering incorrect early returns in the kernel's EROFS parser. Affected kernels prior to stable releases 6.18.16, 6.19.6, and 7.0 are vulnerable; the vendor explicitly notes no system crashes result, limiting impact to gradual resource exhaustion. No public exploit code exists and EPSS sits at 0.02% (4th percentile), indicating negligible observed exploitation interest at time of analysis.
Resource leak in the Linux kernel's hwmon nct7363 hardware monitor driver allows a local, low-privileged user to cause a denial-of-service condition through repeated reference exhaustion. The vulnerability resides in nct7363_present_pwm_fanin, which calls of_parse_phandle_with_args() but never releases the acquired device node reference via of_node_put(), violating the kernel's reference-counting contract for device tree nodes. Exploitation requires physical or local authenticated access to a system equipped with NCT7363 hardware and the driver loaded; no public exploit exists and no active exploitation is confirmed (EPSS: 0.02%, 4th percentile).
NULL pointer dereferences in the Linux kernel's Apple SMC (System Management Controller) MFD driver expose Apple-hardware systems to local denial-of-service. The struct apple_smc mutex was never initialized in apple_smc_probe(), causing occasional crashes when sub-device probe() functions call apple_smc_read() and attempt to acquire the uninitialized lock. Only local, low-privileged users on Apple hardware running an affected kernel can trigger this condition. No public exploit code exists and no active exploitation has been reported; EPSS sits at 0.02% (4th percentile), consistent with a narrow hardware-specific attack surface.
Memory leak in the Linux kernel's MMIO mux driver (mux/mmio subsystem) causes kernel memory exhaustion under local access conditions. The mmio regmap allocated during device probe is never released on probe failure paths or driver unbind, resulting in cumulative memory loss that can degrade availability. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.02% (4th percentile) reflects minimal real-world exploitation interest, consistent with the local-only attack vector and narrow hardware dependency.
Folio reference leaks in the Linux kernel EROFS filesystem driver allow a local low-privileged user to cause gradual memory resource exhaustion by presenting crafted EROFS images with valid but specially structured volume labels. Affected kernel versions span multiple stable branches including the 6.18 and 6.19 series, as confirmed by ENISA EUVD-2026-27717 and upstream kernel commit data. No public exploit has been identified at time of analysis, and the vulnerability description explicitly limits impact to reference leaks without system crashes, which aligns with the low EPSS score of 0.02% (4th percentile).
Local denial-of-service in the Linux kernel's iris media driver (Qualcomm video codec) results from a regression introduced by commit ad699fa78b59241c9d71a8cafb51525f3dab04d4, now reverted. When a media session enters IRIS_INST_ERROR state and userspace subsequently calls stop_streaming for cleanup, the erroneous check skipped the handler entirely - preventing videobuf2 (vb2) buffer returns and leaving firmware in an inconsistent, non-recoverable state. Affected are systems running the iris V4L2 driver on Qualcomm hardware; no public exploit identified at time of analysis and EPSS is 0.02% (percentile 4%), indicating minimal real-world exploitation activity.
Denial of service in the Linux kernel's iris media driver results from improper error-path handling during internal buffer allocation. When DMA allocation via dma_alloc_attrs() fails, a partially initialized buffer that was prematurely added to the internal buffers->list remains in that list, leading to inconsistent kernel state and potential resource leaks or NULL-pointer dereferences on subsequent access. Affected systems running Linux 6.15 through pre-patch versions of 6.18 and 6.19 with the iris media subsystem active are at risk; no public exploit has been identified and EPSS is 0.02%, indicating low exploitation probability at time of analysis.
Kernel oops (crash) in the Linux kernel brcmfmac SDIO Wi-Fi driver allows a local low-privileged user to cause a denial-of-service by triggering a probe failure on Broadcom SDIO Wi-Fi hardware. The root cause is a double-assignment of sdiodev->bus across brcmf_sdio_probe() and brcmf_sdiod_probe(), leaving an invalid (non-NULL, error-valued) pointer that brcmf_sdio_remove() later dereferences during cleanup. No public exploit has been identified, EPSS is at the 4th percentile, and this is not listed in CISA KEV; risk is primarily a kernel stability concern in specific hardware configurations.
Memory exhaustion in the Linux kernel's iris gen1 media driver allows a local low-privileged user to progressively consume kernel memory until session close, causing a denial of service. The iris driver fails to destroy internal firmware-managed buffers upon receiving the firmware release response, with the leak compounding across video resolution changes as each change allocates new buffers without reclaiming the prior set. No public exploit exists and EPSS sits at the 4th percentile, indicating negligible opportunistic exploitation risk; impact is limited to availability on systems with iris-compatible media hardware.
A circular locking dependency in the Linux kernel's ntfs3 filesystem driver allows local authenticated attackers with low privileges to cause a denial of service (system hang or crash) by triggering simultaneous operations that deadlock between the MFT run lock and bitmap read-write lock. The vulnerability affects kernel versions prior to 6.18.16, 6.19.6, and 7.0, and requires local access with user-level privileges to exploit.
NULL pointer dereference in the Linux Kernel ACPI processor subsystem crashes the host system when the cpuidle driver initialization path is invoked in an inconsistent state. Affected kernel builds introduced this regression after commit 7a8c994cbb2d relocated ACPI idle driver registration, leaving the check in `__acpi_processor_start()` referencing a driver that no longer exists at that point in initialization; `__cpuidle_register_device()` then dereferences a NULL pointer, triggering a kernel panic. No public exploit has been identified and EPSS stands at 0.02% (4th percentile), consistent with a reliability regression rather than a targeted attack.
Memory leak in hfsplus filesystem driver causes denial of service when superblock setup fails during mount operations. The vulnerability affects Linux kernels when hfsplus is mounted and the setup_bdev_super() function fails after superblock allocation but before hfsplus_fill_super() completes, leaving filesystem-specific data unfreed. Local authenticated users can trigger this condition to exhaust kernel memory and crash the system.
Data corruption in Linux kernel btrfs filesystem log replay allows local authenticated attackers to cause files to retain incorrect sizes after crash recovery. When a file is truncated to zero bytes, fssynced, and then a hardlink is created, the file incorrectly retains its pre-truncation size after a power failure and log replay, resulting in data integrity violation with availability impact.
Linux kernel shadow stack implementation fails to check for errors from mmap_read_lock_killable() in shstk_pop_sigframe(), allowing a local authenticated attacker to trigger a denial of service by causing the function to proceed with a failed lock acquisition. The vulnerability affects multiple stable kernel versions prior to patched releases 6.18.24, 6.19.14, and 7.0, with EPSS exploitation probability of 0.02% suggesting low real-world exploit likelihood despite the availability of a vendor patch.
Memory leak in the Airoha QDMA RX packet processing function allows local authenticated attackers to cause a denial of service through resource exhaustion. The vulnerability occurs when page pool fragments fail to properly return to the pool during error handling in airoha_qdma_rx_process(), allowing an attacker with local access and low privileges to exhaust kernel memory and crash the system. EPSS exploitation probability is extremely low at 0.02%, reflecting the local-only attack vector and privilege requirement.
Null pointer dereference in Linux kernel bridge VLAN filtering code allows local authenticated attackers to trigger a denial of service via a crafted RTM_NEWLINK netlink message with BR_BOOLOPT_FDB_LOCAL_VLAN_0 flag when CONFIG_BRIDGE_VLAN_FILTERING is disabled. The vulnerability occurs because br_fdb_delete_locals_per_vlan_port() and br_fdb_insert_locals_per_vlan_port() dereference a NULL vlan group pointer without validation, causing a kernel panic. No public exploit code identified at time of analysis.
Infinite vCPU fault loop in the Linux kernel's mshv (Microsoft Hypervisor) subsystem allows a local guest VM process to permanently spin a host vCPU thread, exhausting host CPU resources. The flaw exists in mshv_handle_gpa_intercept(), which unconditionally attempts page remaps on all movable-memory faults regardless of access permission - when a guest writes to a read-only Guest Physical Address region, the remap succeeds but the region retains its read-only designation, causing an immediate re-fault in a tight loop. Affected kernel versions run from commit b9a66cd5ccbb9fade15d0e427e19470d8ad35b75 through the fix commits; patched releases 6.19.14 and 7.0 are available. No public exploit has been identified and EPSS is 0.01%, consistent with the local, hypervisor-specific attack surface.
Off-by-one error in Velocidex Velociraptor before version 0.76.5 on Windows and Linux causes denial of service when parsing specially crafted .evtx files through the parse_evtx VQL plugin. Local attackers with user-level privileges can crash the Velociraptor process by uploading or providing malformed event log files, disrupting forensic investigations and incident response operations. The vulnerability requires user interaction (file upload/selection) but grants an attacker both integrity and availability impact despite the CVSS 4.4 (Medium) rating.
UI spoofing in Google Chrome on iOS prior to version 148.0.7778.96 allows remote attackers to deceive users through crafted HTML pages that manipulate the browser interface. The vulnerability stems from insufficient validation of untrusted input and has a CVSS score of 5.4 (medium severity). Exploitation requires user interaction with a malicious webpage but can result in information disclosure and denial of service on affected iOS devices.
BSON operator injection in ShellHub Community v0.24.1 and earlier allows any authenticated user to crash the device list API endpoint by supplying MongoDB operators as filter field names or sort_by values without input validation. Two attack vectors exist in api/store/mongo/query-options.go: unvalidated filter param.Name values become raw BSON map keys, and the sort_by query parameter is passed directly into a $sort pipeline stage. A validated proof-of-concept exists against v0.24.1. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.06% (19th percentile), indicating low real-world exploitation probability despite a public PoC.
UI spoofing in Google Chrome's Media component prior to version 148.0.7778.96 enables remote attackers to deceive users via a specially crafted HTML page that abuses inappropriate media rendering behavior to misrepresent browser interface elements. The CVSS vector (PR:N/UI:R/S:U) indicates unauthenticated remote exploitation is possible but requires the victim to visit a malicious page, with limited confidentiality impact. SSVC classifies exploitation as none and automatable as no; EPSS at 0.06% (18th percentile) corroborates low exploitation likelihood, and no public exploit or active exploitation has been identified.
UI spoofing via malicious network traffic is possible in Google Chrome's TabGroups component in all versions prior to 148.0.7778.96, exploitable by unauthenticated remote attackers who can induce user interaction. The root cause is insufficient input validation (CWE-20) in the TabGroups feature, allowing crafted network traffic to manipulate browser UI elements and deceive users about page origin or content. No public exploit exists and EPSS sits at 0.05% (17th percentile), consistent with SSVC's 'exploitation: none' and the vendor's own 'Low' Chromium severity rating - real-world risk is low despite the broad attack surface of a ubiquitous browser.
UI spoofing in Google Chrome's Dialog component prior to version 148.0.7778.96 allows a remote attacker who has already compromised the renderer process to deceive users with falsified browser UI elements via a crafted HTML page. The vulnerability stems from insufficient validation of untrusted input (CWE-20) in Dialog handling, enabling manipulation of how dialog boxes are rendered. No public exploit or active exploitation has been identified; EPSS is 0.05% and SSVC classifies exploitation as none, placing real-world urgency well below what the moderate CVSS score alone might suggest.
UI spoofing vulnerability in Google Chrome prior to 148.0.7778.96 allows remote attackers to deceive users through crafted HTML pages that manipulate the speech interface, potentially disclosing sensitive information or causing denial of service. The vulnerability requires user interaction (clicking or interacting with the malicious page) and affects the speech component's visual presentation. Chromium severity is rated Medium; no active exploitation has been publicly confirmed.
UI spoofing via insufficient WebApp policy enforcement in Google Chrome prior to 148.0.7778.96 allows a remote attacker to mislead users about the trustworthiness of browser UI elements by delivering a crafted HTML page. All Chrome users on versions below 148.0.7778.96 are affected across desktop platforms, including those on Red Hat and SUSE Linux distributions. No active exploitation has been identified (SSVC: none; EPSS 0.05%, 16th percentile), and the patch is vendor-confirmed available in the stable channel release.
Stored cross-site scripting in Juzaweb CMS 5.0.0 allows authenticated remote attackers to inject arbitrary JavaScript via the Add Banner Ads function, exploitable with user interaction (page visit). The vulnerability enables credential theft, session hijacking, and defacement of administrative interfaces. A proof-of-concept is publicly available on GitHub, though exploitation requires authenticated access and victim interaction with a malicious payload.
Insufficient policy enforcement in DirectSockets API in Google Chrome prior to version 148.0.7778.96 allows remote attackers to perform arbitrary read and write operations through a crafted malicious Chrome extension. The vulnerability requires user interaction (extension installation) but affects the core security model of the browser's socket access control, exposing local network resources to unauthorized access by untrusted extensions.
Out-of-bounds read and write in the GFX component of Google Chrome prior to version 148.0.7778.96 allows remote attackers to perform arbitrary memory read and write operations through malicious network traffic. The vulnerability requires user interaction (clicking a link or visiting a malicious page) but does not require authentication. Chromium rated the security severity as Medium; CVSS 5.4 reflects moderate impact (confidentiality and integrity compromise without availability loss). No active exploitation confirmed in CISA KEV at time of analysis.
Universal Cross-Site Scripting (UXSS) via MHTML mishandling in Google Chrome prior to 148.0.7778.96 allows a remote attacker - who has first compromised the renderer process - to inject arbitrary scripts or HTML that bypass the Same-Origin Policy, potentially reading cookies and session data across all open origins. The attack is a two-stage chain: a separate renderer exploit must precede this MHTML-based UXSS, substantially raising real-world complexity beyond the raw CVSS score implies. No public exploit or active exploitation has been identified; EPSS sits at 0.03% (7th percentile) and SSVC rates exploitation status as none.
Google Chrome versions prior to 148.0.7778.96 contain an XSS vulnerability in the SanitizerAPI that allows remote attackers to inject arbitrary scripts or HTML through crafted HTML pages. The vulnerability requires user interaction (visiting a malicious page) but carries medium severity due to its ability to compromise confidentiality and integrity. No public exploit code or active exploitation in CISA KEV has been identified at the time of analysis.
Uncontrolled XSS vulnerability in Google Chrome's ServiceWorker implementation prior to version 148.0.7778.96 allows attackers to inject arbitrary scripts or HTML into web pages when users install a malicious Chrome extension, bypassing same-origin policy protections. The vulnerability requires user interaction (extension installation) but can be exploited remotely with low attack complexity. CVSS score of 5.4 reflects medium severity; no active exploitation has been publicly reported.
UI spoofing in Google Chrome's DevTools subsystem (all versions prior to 148.0.7778.96) enables a crafted browser extension to misrepresent critical UI elements to the victim, exploiting an inappropriate implementation classified as CWE-451. The attack requires social engineering the user into installing a malicious extension, after which the extension manipulates DevTools rendering to deceive the user about browser or page state. No active exploitation is confirmed (absent from CISA KEV), EPSS is negligible at 0.01% (3rd percentile), and SSVC rates exploitation as none with partial technical impact, placing this firmly in the low-priority tier despite the Medium CVSS score.
UI spoofing in Google Chrome's DevTools prior to version 148.0.7778.96 enables a crafted extension to misrepresent critical interface information to users, exploitable only after an attacker convinces a target to install the malicious extension. Exploitation requires meaningful social engineering effort and no public exploit code or active exploitation has been identified at time of analysis - SSVC rates exploitation as none and EPSS places this at only the 3rd percentile. The Chrome security team rated this Low severity internally, consistent with the multi-step prerequisite chain and limited post-exploitation impact.
Insecure direct object reference (IDOR) in Cisco Slido REST API allows authenticated remote attackers to view other users' social profile data and manipulate quiz or poll results. The vulnerability requires valid authentication but no user interaction, affecting confidentiality and integrity of user data and poll integrity. Cisco has released a patched version; no public exploit code or active exploitation has been identified at the time of analysis.
Reflected cross-site scripting (XSS) in OpenMage Magento LTS versions up to 20.17.0 allows authenticated admin users to inject arbitrary JavaScript via the Import/Export Dataflow Profiles run interface. The vulnerability exists in the System → Import/Export → Dataflow Profiles page where unsanitized filename parameters are reflected into HTML context, enabling cookie theft and admin panel defacement. The exploitation requires admin panel access and user interaction to click a malicious link, but no network-based unauthenticated exploitation is possible.
Proxy scope bypass in Nitro (npm packages nitropack and nitro) allows unauthenticated remote attackers to reach upstream paths outside the configured routeRules wildcard scope by embedding percent-encoded path traversal sequences (`..%2f`) in HTTP requests. Nitro's route-rule matcher treats `%2F` as an opaque literal and matches the rule, then forwards the raw un-canonicalized path to the upstream; upstreams that decode `%2F` to `/` then resolve the `..` segment and serve resources the developer intended to be fenced off, such as internal admin or secrets endpoints. No public exploit code is identified at time of analysis and EPSS is low at 0.04% (13th percentile), but the official advisory includes a precise proof-of-concept request and the exploit prerequisite (upstream `%2F` decoding) is common in static file servers, CGI handlers, Python os.path routers, and microservice mesh layers.
Open redirect in Nitro (npm packages `nitropack` and `nitro`) allows unauthenticated remote attackers to redirect users to arbitrary external hosts by inserting a double slash after a wildcard route rule prefix. Nitro's `withoutBase` path-stripping preserved `//evil.com` remnants verbatim in `Location` response headers; browsers silently resolve `//host` as a protocol-relative URL against the current scheme, sending victims to attacker-controlled infrastructure while the initial URL appears to belong to the legitimate server. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.04%, but the attack is trivially reproducible from the advisory description alone; patched versions are available.
PyLoad-ng WebUI discloses internal Python stack traces and source file paths to unauthenticated remote attackers via a global exception handler on the `/web/<path:filename>` endpoint. An attacker can request non-existent templates or craft malformed requests to trigger server exceptions and extract implementation details in HTTP responses without authentication. This information disclosure facilitates reconnaissance for follow-on attacks but does not enable direct code execution or data theft.
HCL DFXAnalytics fails to enforce strict Content-Security-Policy (CSP) directives for object-src and base-uri, enabling attackers to inject and execute arbitrary scripts through cross-site scripting (XSS) vectors without authentication or user interaction. This network-accessible vulnerability affects all versions and results in information disclosure with a CVSS score of 5.3; no active exploitation has been reported.
Uninitialized memory use in the GPU component of Google Chrome prior to version 148.0.7778.96 allows remote attackers who have compromised the renderer process to extract potentially sensitive information from process memory through a malicious HTML page. The vulnerability requires renderer process compromise as a precondition and user interaction to trigger, but once achieved, enables confidentiality breach with no code execution or denial of service impact. Vendor-released patch available in Chrome 148.0.7778.96.
Statamic CMS versions before 5.73.21 and 6.0-6.14.x disclose whether an email address is registered via differential responses from the forgot password endpoint, enabling unauthenticated attackers to enumerate valid user accounts and facilitate downstream credential-based attacks. The vulnerability has a CVSS score of 5.3 (low confidentiality impact) and no public exploit code or active exploitation has been identified.
Information disclosure in Google Chrome prior to 148.0.7778.96 allows remote attackers who have compromised the renderer process to extract potentially sensitive data from process memory through a race condition triggered by a crafted HTML page. The vulnerability requires renderer process compromise and user interaction but results in high confidentiality impact with no integrity or availability consequences. Chromium security team rates this as Medium severity; no active exploitation has been publicly confirmed.