Deadlock in the Linux kernel btrfs filesystem subsystem triggers an unrecoverable kernel hang when the flushoncommit mount option is active and a reflink operation copies an inline extent to a destination offset beyond the target inode's i_size. The circular wait arises because the reflink task holds the extent io tree lock while blocking on a pending transaction commit, while the commit's delalloc flush simultaneously blocks trying to acquire that same held lock. No public exploit or CISA KEV listing exists; EPSS is 0.18% (8th percentile), reflecting very low real-world exploitation interest.
Stack exhaustion in the Linux kernel batman-adv mesh networking subsystem allows an attacker on the same batman-adv mesh to crash the kernel by sending matryoshka-nested BATADV_UNICAST_FRAG packets. The reassembled payload's packet type is not validated before re-processing, enabling unbounded recursion in batadv_batman_skb_recv() that exhausts kernel stack and causes a hard system crash. No active exploitation is recorded in CISA KEV and EPSS sits at 0.18% (7th percentile), making this a targeted DoS risk limited to environments running batman-adv mesh networking.
Null pointer dereference in the Linux kernel's BPF LWT (Lightweight Tunnel) subsystem allows a local user with BPF syscall privileges to crash the kernel via a denial-of-service. The flaw exists because bpf_prog_test_run_skb constructs a socket buffer (skb) without initializing skb->_skb_refdst; when a BPF program invokes the bpf_lwt_xmit_push_encap helper through this test path, the subsequent dereference of skb_dst(skb)->dev hits a null pointer and triggers a kernel panic. No public exploit or CISA KEV listing exists, and EPSS is very low at 0.18% (7th percentile), consistent with the specialized access required.
Error pointer dereference in the Linux kernel's brcmfmac Broadcom WiFi driver allows a local low-privilege attacker to crash the kernel via a NULL pointer dereference, resulting in denial of service. The function brcmf_chip_add_core() in brcmf_chip_recognition() can return an ERR_PTR sentinel value that is never validated before being dereferenced at five separate code sites (lines 1010-1022 of chip.c), as identified by Smatch static analysis. No public exploit or active exploitation has been identified; EPSS sits at 0.18% (7th percentile), consistent with a low-priority local DoS affecting only systems with Broadcom WiFi hardware.
NULL pointer dereference in the Linux kernel dm-cache subsystem crashes the kernel when concurrent writes target the same cached block in passthrough mode. The flaw affects any kernel with a dm-cache device explicitly configured in passthrough mode since version 4.12, allowing a local low-privileged user with write access to the block device to cause a kernel panic and complete denial of service. No public exploit code exists and EPSS at 0.18% (7th percentile) confirms very low exploitation probability; fixed across multiple stable kernel series with patches confirmed by Ubuntu security advisories.
Data loss in the Linux kernel dm-cache subsystem occurs when LVM's table preload feature is used to switch a writeback cache to passthrough mode while dirty mappings exist. The dirty mapping check was designed assuming table reloads happen only after device suspension (which flushes dirty blocks), but LVM's preload path bypasses this assumption, allowing dirty cache blocks to be silently loaded into passthrough mode where they will never be written back to the origin device. No public exploit code exists; reproduction requires a deliberate sequence of dmsetup and fio operations documented in the CVE description itself. EPSS is 0.18% (7th percentile), consistent with a local, configuration-specific data-loss condition rather than a remotely exploitable flaw.
Kernel panic via reachable assertion in the OCFS2 cluster filesystem allows a local, low-privileged user to crash the system by issuing a crafted OCFS2_IOC_GROUP_ADD ioctl. The root cause is that ocfs2_group_add() invokes ocfs2_set_new_buffer_uptodate() on a user-supplied group block number before ocfs2_verify_group_and_input() has validated that number; if the block already exists in the metadata cache, the BUG_ON at uptodate.c:509 fires unconditionally, triggering a kernel oops. No public exploit has been identified and EPSS is 0.18% (7th percentile), but the fix is widely available across maintained stable branches.
Deadlock in the Linux kernel's usbhid driver (`hid_post_reset()`) can halt systems connected to composite USB devices that combine HID and block storage or UAS components. When such a device undergoes a reset during block IO error handling, memory allocations using the default GFP_KERNEL flag can trigger block IO reclaim, which deadlocks against the mutex already held by the reset path - producing a kernel hang. No public exploit has been identified, and EPSS of 0.18% (7th percentile) confirms very low exploitation likelihood; the fix replaces GFP_KERNEL with GFP_NOIO across all affected reset callbacks, and patches are available across multiple Linux stable branches.
Integer overflow in the Linux kernel SCSI target core allows a local attacker with low privileges to crash the kernel via crafted UNMAP commands. The `sbc_execute_unmap()` function performs a capacity bounds check on LBA + range but fails to guard against 64-bit wraparound, meaning an attacker can supply values that overflow to bypass the check and trigger a kernel panic. No public exploit code or CISA KEV listing exists; EPSS is 0.18% (7th percentile), reflecting the niche attack surface limited to systems actively running SCSI target daemons. Patches are confirmed available across all supported stable kernel branches.
Denial of service in the Linux kernel's netfilter xtables subsystem exposes systems to local kernel panics caused by using inet-specific match extensions (xt_mac, xt_owner, xt_physdev, xt_realm) in incompatible protocol family contexts such as ebtables. The flaw was introduced by commit ab4f21e6fb1c, which broadened these extensions to NFPROTO_UNSPEC, inadvertently permitting their use in Ethernet bridge filtering contexts where IPv4-specific kernel data structures (e.g., dst->tclassid for xt_realm) are undefined or null. No public exploit has been identified and EPSS is 0.18% at the 7th percentile, indicating low adversarial interest despite the ubiquitous deployment footprint of the Linux kernel.
Stack memory disclosure in the Linux kernel RDS/IB subsystem exposes up to 26 bytes of uninitialized kernel stack contents - including kernel text and data pointers - to local unprivileged users via the getsockopt(SOL_RDS, RDS_INFO_IB_CONNECTIONS) interface. The leak enables KASLR bypass on systems where the kernel was built without CONFIG_INIT_STACK_ALL_ZERO=y, making this a useful primitive for chaining into privilege escalation. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS is very low at 0.18% (7th percentile), but the CVE description itself supplies a complete, step-by-step reproduction recipe that reduces practical exploitation complexity to near-trivial for any local user with AF_RDS socket access.
Uninitialized memory use in the Linux kernel netdevsim subsystem allows a local low-privileged attacker to cause kernel crashes or potentially expose residual kernel heap contents via dummy packet trap operations. The root defect is in `nsim_dev_trap_skb_build`, where `skb_put` allocated space for a `struct iphdr` without zeroing it, leaving uninitialized kernel memory accessible in a dummy `sk_buff`. No public exploit code exists and the vulnerability is not in CISA KEV; EPSS stands at 0.18% (7th percentile), consistent with negligible opportunistic exploitation risk. Vendor-released patches are confirmed across all actively supported stable kernel branches.
NULL pointer dereference in the Linux kernel's batman-adv OGMv2 subsystem allows a local low-privilege user to crash the kernel by racing interface teardown against OGM dispatch. When a batman-adv hard interface is disabled and its mesh_iface pointer is set to NULL, the batadv_v_ogm_queue_on_if() function continues to call netdev_priv() on that NULL pointer, triggering a kernel panic. No public exploit exists and EPSS is 0.18% (7th percentile), making this low operational priority except on systems actively running batman-adv mesh networking.
Operation sequencing flaw in the Linux kernel's tegra194 PCIe endpoint driver causes a Control Backbone (CBB) timeout when PERST# is deasserted twice in succession. During the second deassert cycle, the driver invokes pci_epc_deinit_notify() and dw_pcie_ep_cleanup() - which access DBI register PCIE_MISC_CONTROL_1_OFF at offset 0x8bc - before reset_control_deassert() powers on the PCIe controller core, triggering a hardware bus timeout and denying availability of the PCIe subsystem. With an EPSS of 0.18% (7th percentile), no CISA KEV listing, and hardware-specific scope limited to NVIDIA Tegra194 SoCs, this is a low-probability exploitation target with real-world impact confined to embedded and automotive Linux deployments.
Resource leak in the Linux kernel fsnotify subsystem causes hung tasks and local denial of service via a race condition in fsnotify_recalc_mask(). A local low-privilege user can trigger concurrent mark addition and removal on a filesystem connector object, causing an inode pointer returned by __fsnotify_recalc_mask() to be silently discarded rather than released via fsnotify_drop_object() - permanently blocking the umount path as fsnotify_sb_delete() waits indefinitely on the leaked reference. No public exploit exists and EPSS is at the 7th percentile, indicating negligible opportunistic exploitation risk.
Out-of-bounds descriptor read in the Linux kernel ALSA USB MIDI 2.0 subsystem allows a physically proximate or low-privileged local attacker to crash the kernel by presenting a malformed USB audio device with crafted MIDI 2.0 endpoint descriptors. The USB MIDI 2.0 endpoint parser validates bLength against bNumGrpTrmBlock but omits validation against remaining bytes in the endpoint-extra scan, allowing baAssoGrpTrmBlkID[] reads to advance past the descriptor buffer boundary. No public exploit is identified; EPSS stands at 0.18% (7th percentile), consistent with narrow, hardware-dependent attack surface and no active exploitation.
NULL pointer dereference in the Linux kernel's sch_dualpi2 queuing discipline (net/sched) allows a local attacker with low privileges to crash the kernel, causing a denial of service. The flaw exists in dualpi2_change(), which enforces updated queue limits after a qdisc reconfiguration: when traffic is exclusively queued in the L-queue and the C-queue is empty, the function unconditionally dereferences the NULL skb returned by the C-queue dequeue path, triggering a kernel panic. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), consistent with a locally-triggered, configuration-dependent kernel bug.
Improper RLIMIT_MEMLOCK accounting in the Linux kernel's vsock/virtio MSG_ZEROCOPY path allows a local low-privileged user to bypass per-process pinned-page limits, enabling unbounded kernel memory pinning that can drive the system toward memory exhaustion. The flaw is confined to the virtio vsock transport and is not remotely exploitable. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), reflecting low exploitation interest; however, a vendor-confirmed fix is available in stable releases.
Missing CAP_NET_ADMIN enforcement in the Linux kernel PSP (PSP Security Protocol) netlink subsystem allows any local user with low privileges within the same network namespace to invoke the dev-set and key-rotate operations - modifying PSP version configuration and rotating cryptographic key material without authorization. The only access control in place, psp_dev_check_access(), validates only network namespace membership and does not enforce administrative capability. This enables unauthorized disruption of PSP-encrypted network communications and unauthorized modification of in-use cryptographic keying material. No public exploit code has been identified at time of analysis, and EPSS exploitation probability is very low at 0.17% (7th percentile).
NULL pointer dereference in the Linux kernel's Traffic Control cls_fw (firewall classifier) module causes a local denial of service via kernel crash. Affected kernels from commit ed76f5edccc9 onward publish TC filters to the shared datapath block before the ->change() validation function runs; an attacker with CAP_NET_ADMIN who adds an invalid 'old-style' cls_fw filter to a shared block can trigger fw_classify() to dereference a NULL 'q->handle' pointer when live traffic hits the unvalidated filter. No public exploit or KEV listing exists at time of analysis, and EPSS sits at the 7th percentile (0.17%), consistent with a kernel-local, capability-gated DoS.
Null pointer dereference in the Linux kernel Bluetooth HCI UART line discipline driver (hci_ldisc) allows local low-privileged users on systems with UART-attached Bluetooth hardware to crash the kernel, causing denial of service. The flaw spans multiple stable kernel branches from 5.4.x through 6.15 and stems from a missing flag clear in the error path of hci_uart_register_dev(). No public exploit code exists and EPSS sits at the 7th percentile (0.17%), indicating low real-world exploitation probability; patched versions are available across all affected stable branches.
Resource leak in the Linux kernel ASoC STI audio driver allows a local authenticated user to exhaust kernel memory by repeatedly loading and unloading the driver, degrading system availability. The vulnerability stems from regmap_field objects allocated during STI audio player initialization never being released on driver removal. With EPSS at 0.17% (7th percentile), no KEV listing, and no public exploit, this is a low-priority maintenance fix rather than an actively weaponizable flaw. Vendor-released patches are available across multiple stable kernel branches.
Incorrect memory access in the Linux kernel's ASoC Qualcomm QDSP6 audio topology driver can trigger a kernel panic on affected Qualcomm Snapdragon hardware when virtual DAPM widgets are processed without a type guard. The flaw, introduced at commit 36ad9bf1d93d66b901342eab9f8ed6c1537655a6, affects kernel branches from 5.16 onward until the respective stable fixes. No active exploitation has been identified (not in CISA KEV) and the EPSS score of 0.17% (7th percentile) reflects negligible real-world exploitation probability; hardware dependency further constrains the affected population.
NULL pointer dereference in the GFS2 filesystem's log release path crashes the Linux kernel during unmount on affected versions. The vulnerability arises because gfs2_log_release() dereferences sdp->sd_jdesc without checking for NULL, which can occur after the journal descriptor has already been freed during the unmount sequence. A prior fix (commit 35264909e9d1) addressed the same class of bug in gfs2_log_flush() but left gfs2_log_release() unprotected. No public exploit exists (EPSS 0.17%), exploitation is limited to local access on GFS2-mounted systems, and patches are available across all affected stable kernel branches.
The Linux kernel's BPF sockmap subsystem deadlocks when a BPF iterator program iterating over AF_UNIX sockets via `bpf_iter_unix_seq_show()` simultaneously attempts to update a sockmap entry during the same execution context. When `lock_sock_fast()` takes the spinlock fast path and holds `slock-AF_UNIX`, any subsequent `sock_map_update_elem()` call within the BPF iterator program spins indefinitely attempting to re-acquire the same spinlock on the same CPU, causing an unrecoverable kernel deadlock and loss of system availability. This is not confirmed actively exploited (not in CISA KEV), no public exploit has been identified, and EPSS at 0.17% (7th percentile) confirms negligible current exploitation interest; the real-world risk is constrained to specialized BPF workloads with specific capability requirements.
Uninitialized variable read in the NTFS3 filesystem driver (`ntfs_iomap_begin()`) of the Linux kernel allows a local authenticated user to crash the system by triggering a zero-length run condition that causes the `lcn` (logical cluster number) variable to be consumed before assignment. The flaw affects Linux 7.0 up to 7.0.10 and Linux 7.1 prior to the stable fix commits, with the defect discovered and confirmed by Google syzbot via KMSAN. No public exploit has been identified and EPSS probability is very low (0.17%, 7th percentile); patches are available in Linux 7.0.10 and 7.1.
Missing NUL termination in the Linux kernel's ntfs3 filesystem driver allows a local attacker with filesystem mount privileges to trigger an out-of-bounds memory read, crashing the kernel. The defect in ntfs_fill_super() leaves sbi->volume.label unterminated when a UTF-16 volume label converts to a UTF-8 string that exactly fills the fixed buffer, causing ntfs3_label_show() to read past the buffer boundary via a %s format specifier. No public exploit has been identified at time of analysis and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation interest despite the High availability impact in CVSS.
Unbounded string concatenation in the Linux kernel's Dell WMI BIOS interface driver (dell-wmi-sysman) allows a local low-privileged attacker on Dell hardware to crash the kernel. The populate_enum_data() function bounds each individual firmware-provided string but applies no remaining-space check during cumulative strcat() calls into fixed 512-byte struct members, enabling a buffer overflow that results in complete system availability loss. With an EPSS of 0.17% (7th percentile), no public exploit code, and no CISA KEV listing, this is a low-likelihood but straightforward local denial-of-service on Dell platforms running unpatched kernel versions.
Livelock in the Linux kernel's futex requeue-PI subsystem can hang a system when a signal or timeout interrupts a FUTEX_WAIT_REQUEUE_PI operation concurrently with an active FUTEX_CQ_REQUEUE_PI requeue. The race causes a waiting thread (Task A) to block indefinitely on a hash-bucket lock while a requeue thread (Task B) busy-loops retrying the same operation, consuming all available CPU - worst-case on uniprocessor systems where Task A cannot be scheduled at all. No public exploit is identified and EPSS is 0.17% (7th percentile), but the deterministic nature of the livelock on UP or real-time-scheduled hardware makes this a genuine denial-of-service risk; patches are available across six Linux stable branches.
Deadlock in the Linux kernel's md/raid456 subsystem during array reshape allows a local low-privileged user to hang the system indefinitely. When direct I/O spans the reshape position in a RAID 4/5/6 array, the I/O blocks in raid5_make_request() holding an active_io reference while waiting for reshape progress. If an administrator concurrently freezes the reshape and writes to md/suspend_lo or md/suspend_hi, mddev_suspend() deadlocks: it waits for active_io to drain, but the blocked I/O requires reshape progress that the frozen reshape thread can never provide. Exploitation requires a very specific confluence of conditions and no public exploit code or active exploitation (CISA KEV) has been identified; EPSS at 0.17% (7th percentile) confirms low real-world exploitation probability.
Improper locking in the Linux kernel's md (Multiple Devices/software RAID) subsystem causes a recursive kobject teardown deadlock when 'clear' is written to the sysfs array_state attribute. A local user with write access to an active md array's sysfs interface can trigger a kernel denial-of-service by exploiting the incorrect ordering of mddev_put() before sysfs_unbreak_active_protection() in md_attr_store(). No public exploit code is identified and EPSS exploitation probability is minimal at 0.17% (7th percentile); no CISA KEV listing indicates active exploitation has not been confirmed.
NULL pointer dereference in the Linux kernel's MediaTek mt76/mt7925 WiFi driver crashes affected systems when the `vif` (virtual interface) pointer is uninitialized at the time `mt7925_mac_write_txwi` calls `ieee80211_vif_is_mld(vif)`. Local low-privilege users on systems equipped with mt7925 hardware and running unpatched kernels can trigger a kernel panic, resulting in a denial of service. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.17% (6th percentile) reflects negligible real-world exploitation probability at this time.
NULL pointer dereference in the Linux kernel's DRM Cadence MHDP8546 DisplayPort bridge driver (cdns-mhdp8546-core) can be triggered by a local low-privileged user on systems with the affected hardware, causing a kernel panic and complete system availability loss. The flaw arises when error recovery paths in cdns_mhdp_modeset_retry_fn() attempt to access a mutex via a connector pointer that has not yet been initialized in the DRM_BRIDGE_ATTACH_NO_CONNECTOR code path. No public exploit code or active exploitation (CISA KEV) has been identified; patches are available across multiple stable kernel branches.
Out-of-bounds read in the Linux kernel's IMA (Integrity Measurement Architecture) filesystem subsystem causes a kernel panic during boot on systems with TPM chips advertising hash algorithms unsupported by the kernel. Specifically, when `ima_tpm_chip->allocated_banks[i].crypto_id` is set to the sentinel `HASH_ALGO__LAST` for an unmapped TPM algorithm (demonstrated with TPM_ALG_SHA3_256 = 0x0027), the `create_securityfs_measurement_lists` function dereferences the out-of-range index into `hash_algo_name[]`, triggering a KASAN-detected global-out-of-bounds read and kernel crash. No public exploit has been identified and EPSS is 0.17% (6th percentile), making deliberate exploitation unlikely; the primary risk is inadvertent boot-time denial of service on hardware with qualifying TPM chips.
NULL pointer dereference in the Linux kernel's BPF verifier crashes the kernel when a scalar register is stored into a kptr map slot during BPF program loading. Introduced by commit ab6c637ad027, which refactored map_kptr_match_type() to call btf_is_kernel(reg->btf) before the guard that excludes non-BTF register types - exposing scalar registers (reg->btf == NULL) to an immediate NULL dereference. A local user with BPF syscall access can trigger a kernel panic, producing a denial of service. No active exploitation is confirmed (not in CISA KEV), and EPSS is low at 0.17% (6th percentile), consistent with the local-only, DoS-limited impact.
Integer truncation in the Linux kernel's EROFS filesystem driver on 32-bit platforms causes logical cluster number (LCN) calculations to overflow at the 4 GiB boundary, resulting in incorrect block addressing and potential kernel-level availability impact. Affected systems are those running 32-bit Linux kernels (where `unsigned long` is 32 bits wide) with EROFS filesystems mounted. No public exploit exists and no active exploitation has been confirmed; EPSS stands at a very low 0.17% (6th percentile), consistent with the niche attack surface of 32-bit deployments.
Kernel panic via skb headroom exhaustion in the Linux kernel's Traffic Control (TC) act_mirred subsystem affects systems using block-cast packet redirection across mixed device types. The root cause is a copy-paste error in tcf_blockcast_redir() where dev_is_mac_header_xmit() is queried against the next device in the iteration (dev) rather than the device currently being transmitted to (dev_prev), causing tcf_mirred_to_dev() to make wrong MAC header push/pull decisions for intermediate devices. In the worst case, skb_push_rcsum is called with an incorrect mac_len, exhausting socket buffer headroom and triggering a kernel panic. No public exploit code has been identified and EPSS is 0.17% at the 6th percentile, consistent with low real-world exploitation interest.
Denial-of-service in the Linux kernel macvlan driver allows local users with network interface management privileges to crash netlink interface dumps by exploiting a missing netlink buffer size reservation for the IFLA_MACVLAN_BC_CUTOFF attribute. When bc_cutoff is set to any value other than the default (1) on a macvlan bridge interface, any subsequent attempt to dump that interface via GETLINK triggers nla_put_s32() to return -EMSGSIZE, fires a WARN_ON in rtnetlink, and prevents the interface from being enumerated. No public exploit tool has been identified and no active exploitation is confirmed; EPSS is 0.17% (6th percentile).
Kernel crash via scheduler state corruption in the Linux kernel's CFS/EEVDF fair scheduler allows a local user to cause a NULL pointer dereference and system denial of service. When a task is forked while the parent's sched_entity has rel_deadline set, the child inherits stale deadline state that __sched_fork() fails to clear; a subsequent sched_yield() call on the child inflates vruntime by approximately 2x (observed: ~9.8e15 jumping to ~1.9e16), corrupting cfs_rq->sum_w_vruntime and ultimately causing pick_next_entity() to return NULL unexpectedly. No active exploitation has been identified (EPSS 0.17%, not in CISA KEV), and upstream stable patches are available across multiple kernel branches.
An infinite loop condition in the Linux kernel's DRM/TTM GPU memory management subsystem allows a local unprivileged user to cause a system-level denial of service. When `ttm_bo_swapout()` encounters a swapout failure, the error recovery path incorrectly repositions the buffer object at the tail of the LRU list - placing it ahead of the walk cursor's hitch node - so the subsequent `list_for_each_entry_continue()` repeatedly processes the same resource indefinitely, hanging the kernel's memory reclaim path. No public exploit has been identified and EPSS probability is 0.17% (6th percentile), but the stable kernel patch is confirmed available via two upstream commits.
Memory exhaustion in the Linux kernel mt76 WiFi driver allows a local low-privileged user on systems with MediaTek MT76 hardware to cause denial of service through kernel memory leakage during module teardown. The mt76_dma_cleanup routine fails to destroy page_pools associated with WED RRO receive queues (queues not tied to NAPI), and does not return pages to the pool when WED is not enabled - resulting in unreclaimed kernel memory on each module unload cycle. No public exploit exists and EPSS probability sits at 0.17% (6th percentile), consistent with a niche hardware-specific leak with no code-execution path.
Deadlock in the Linux kernel's mt76/mt7925 MediaTek WiFi driver can be triggered by a local low-privileged user, causing the wireless networking subsystem to hang indefinitely. The flaw exists in mt7925_roc_abort_sync(), which calls cancel_work_sync() while already holding dev->mt76.mutex - the same mutex held by roc_work() - producing a classic mutual-wait deadlock with no path to resolution. Systems running affected kernel versions with MediaTek MT7925 WiFi hardware are vulnerable to a local denial of service; no public exploit has been identified and EPSS places exploitation probability at 0.17% (6th percentile), consistent with the niche hardware requirement.
Mutex deadlock in the Linux kernel's mt7921 WiFi driver (mt76/mt7921 subsystem) can render the WiFi subsystem permanently unresponsive on affected systems. The deadlock arises during station removal: the call chain mt76_sta_state() → mt76_sta_remove() → mt7921_mac_sta_remove() → mt7921_roc_abort_sync() invokes cancel_work_sync() while roc_work() holds dev->mt76.mutex and the removal path already owns the same lock - a classic ABBA deadlock with no progress possible. No public exploit is identified and EPSS sits at 0.17% (6th percentile), placing this firmly in the patch-and-move-on category for most organisations, though Linux distributions serving MT7921 hardware (common in consumer laptops) should prioritise kernel updates.
Deadlock in the Linux kernel mt76 WiFi driver's remain-on-channel path allows a local low-privileged user to crash or hang the WiFi subsystem. The flaw affects kernels containing the mt76 driver from commit a8f424c128 through the fixed releases (6.18.33, 7.0.10, 7.1), with no confidentiality or integrity impact - only availability. No public exploit code exists and EPSS sits at 0.17% (6th percentile), consistent with a local, hardware-specific denial-of-service with negligible opportunistic exploitation risk.
BPF subsystem argument-tampering in the Linux kernel allows local attackers with CAP_BPF privileges to abuse the kprobe+freplace program chaining path to overwrite kernel function arguments via a manipulated `struct pt_regs`, causing kernel denial of service or subversion of kernel function behavior. The root mechanism is that freplace programs inherit the `kprobe_write_ctx=true` permission from a parent kprobe program, enabling register writes that should be confined to uprobe contexts. No public exploit or CISA KEV listing is confirmed; EPSS sits at the 6th percentile. Patches are available in Linux 6.18.33, 7.0.10, and the 7.1 mainline branch.
NULL pointer dereference in the Linux kernel's fwctl subsystem allows a local low-privilege user to crash the kernel when CXL memory expansion hardware is present and a device removal is triggered. The defect stems from a deterministic module initialization ordering race between the CXL and fwctl drivers, leaving knode_class uninitialized at device registration time and causing device_del() to dereference it fatally on removal. No public exploit identified at time of analysis; EPSS of 0.17% (6th percentile) reflects very low exploitation probability consistent with the local-only attack surface.
Memory leak in the Linux kernel's Renesas i3c master driver causes local denial of service through kernel memory exhaustion. Specifically, the xfer structure allocated by renesas_i3c_alloc_xfer() inside renesas_i3c_i3c_xfers() is never released, allowing a local user with low privileges on affected Renesas SoC hardware to exhaust kernel memory by repeatedly triggering i3c transfers. No public exploit has been identified at time of analysis, and EPSS probability sits at 0.17% (6th percentile), reflecting low real-world exploitation interest.
Error pointer dereference in the Linux kernel USB Type-C TI Power Delivery (tipd) driver allows a local low-privileged user to crash the kernel (denial of service) on systems with TI CD321x or TPS6598x USB Type-C controller hardware. The flaw in `cd321x_update_work()` at `drivers/usb/typec/tipd/core.c:827` logs a warning when `typec_register_partner()` fails but omits an early return, causing a subsequent unconditional dereference of the error pointer via `typec_partner_set_identity()`. No public exploit code has been identified at time of analysis, EPSS probability is 0.17% (6th percentile), and the vulnerability is not listed in CISA KEV.
Kernel panic in the SpaceMIT clock controller driver (`clk-spacemit-ccu`) can be triggered during CPU frequency scaling on systems running SpaceMIT RISC-V hardware. The root cause is an inverted boolean condition in `ccu_mix_trigger_fc()` that causes the frequency change trigger to be skipped at the wrong time and fired at the wrong time, crashing the kernel under normal cpufreq governor activity. Exploitation requires only local low-privilege access, but is practically limited to the narrow hardware footprint of SpaceMIT K1-based boards; no public exploit or CISA KEV listing exists, and EPSS is 0.17% (6th percentile).
Kernel panic in the Linux f2fs garbage collector allows a local low-privileged user to crash the system by triggering a VM_BUG_ON_FOLIO assertion when GC attempts to re-read a page already marked uptodate after multiple block relocations. The affected subsystem is f2fs (Flash-Friendly File System); systems using ext4, XFS, or other filesystems are not impacted. EPSS is extremely low (0.17%, 6th percentile) and no active exploitation has been identified, making this a stability/DoS concern primarily relevant to mobile, embedded, and flash-storage Linux deployments.