Ceph filesystem client in the Linux kernel panics with a BUG_ON assertion in __ceph_build_xattrs_blob() due to a race condition that leaves a pre-calculated xattr blob size stale, introduced by an earlier commit that restructured size computation order. All kernels from Linux 6.0 onward running a CephFS mount are affected, with fixed releases available at 6.12.91, 6.18.33, 7.0.10, and 7.1. A local low-privileged user with access to a Ceph-mounted filesystem can trigger a kernel panic causing complete system denial of service; no public exploit code or CISA KEV listing exists at time of analysis.
Heap buffer overflow in the Linux kernel EFI capsule loader arises from an incorrect sizeof operand in a krealloc() call inside __efi_capsule_setup_info(), allocating half the required space on 32-bit PAE systems where phys_addr_t is 64-bit but pointers are 32-bit. When physical addresses are subsequently written via page_to_phys(), the undersized heap buffer is overflowed, corrupting kernel heap metadata and causing a system crash. Exploitation is architecturally constrained to 32-bit PAE kernels; 64-bit systems are unaffected because sizeof(phys_addr_t) equals sizeof(phys_addr_t*). No public exploit exists, EPSS is 0.19% (9th percentile), and no active exploitation has been recorded.
Resource exhaustion in the Linux kernel ksmbd SMB server allows a low-privileged authenticated SMB client to leak kernel file descriptor references by sending repeated SMB2 CREATE requests with a DURABLE_HANDLE_REQUEST_V2 context that produces a CreateGuid hit but a ClientGUID mismatch. Each such request increments the refcount on a ksmbd_file via ksmbd_fp_get() in ksmbd_lookup_fd_cguid() but the mismatch code path never calls the matching release, causing global_ft entries to be pinned indefinitely. Over time this defeats the durable file scavenger and causes long-lived kernel resource leaks that can degrade or deny availability. No public exploit has been identified at time of analysis and EPSS is 0.19% (9th percentile), indicating low opportunistic exploitation probability.
Kernel availability impact in the Linux DRM PRIME buffer-sharing subsystem results from a pointer replacement logic error introduced by commit 5e28b7b94408, where the new IDR object pointer fails to overwrite the original handle's pointer at the correct location during the 'change handle' flow. Local users with low privileges holding access to a DRM device node can trigger a kernel WARNING assertion failure in drm_prime_destroy_file_private (drm_prime.c:224) upon file close, destabilizing the system. No public exploit exists and EPSS sits at 0.19% (8th percentile), indicating low real-world exploitation probability; the vendor patch is available in Linux stable trees at 7.0.10 and 6.18.33.
NULL pointer dereference in the Linux kernel nexthop routing subsystem allows a local privileged attacker to crash the kernel (denial of service) by exploiting a stale address-family flag state. The `has_v4` flag in nexthop groups is not updated when an IPv6 nexthop is replaced with an IPv4 one, letting a corrupt group bypass `fib6_check_nexthop` validation and attach to an IPv6 route; subsequent traffic through that route calls `nexthop_fib6_nh()`, which returns NULL for the AF_INET member, triggering the panic. No public exploit identified at time of analysis, though the CVE disclosure itself includes a functional step-by-step reproducer using standard `ip nexthop` and `ip route` commands, and the EPSS score of 0.18% (8th percentile) reflects low current real-world exploitation pressure.
Integer overflow in the Linux kernel i2c character device driver allows a local low-privileged user to corrupt the SMBus controller state machine and cause a persistent Denial of Service. By supplying a crafted large timeout value (e.g., 429496729) to the I2C_TIMEOUT ioctl that passes the INT_MAX bounds check but overflows to a negative integer after multiplication by 10, an attacker forces wait_for_completion_timeout() to receive a sign-extended negative 64-bit value, triggering schedule_timeout kernel warnings and leaving the SMBus adapter in an unrecoverable state. No public exploit has been identified at time of analysis and EPSS is 0.18% (8th percentile), reflecting low mass-exploitation risk; however, the flaw is mechanically straightforward on any system granting unprivileged access to /dev/i2c-* nodes.
Memory leak in the Linux kernel dm-cache metadata subsystem can be triggered by local users with low privileges to gradually exhaust kernel memory, causing system availability degradation. The flaw resides in dm_cache_metadata_abort, where a temporary block_manager object allocated before acquiring root_lock is not freed when the lock acquisition fails due to a read-only block manager - a condition reproducible by reloading a dm-cache table during metadata error states. No public exploit code and no CISA KEV listing have been identified; EPSS of 0.18% (8th percentile) confirms very low current exploitation probability.
Unbounded queue growth in the Linux kernel's netem (Network Emulator) traffic control subsystem allows a local low-privileged user to exhaust kernel memory and trigger a denial of service. The flaw exists because netem_enqueue() enforces queue depth limits using only q->t_len (packets in the internal tfifo), while packets placed into sch->q via the reorder path (__qdisc_enqueue_head) are silently excluded from that count, allowing total queue occupancy to grow beyond sch->limit without bound. No public exploit has been identified and the EPSS score of 0.18% (8th percentile) places this in the lowest exploitation-probability tier; however, the vulnerability affects a wide range of active stable kernel branches and patched versions are available.
Reference count exhaustion in the Linux kernel's netfilter nft_ct subsystem allows a local low-privileged user to trigger a denial-of-service condition by repeatedly invoking nftables rules that use the ct expect object type. The function nft_ct_expect_obj_eval() allocates a connection tracking expectation and may call nf_ct_expect_related(), but never releases the local reference via nf_ct_expect_put() before returning, causing an unbounded accumulation of unreleased kernel memory references. No public exploit exists and EPSS probability stands at 0.18% (8th percentile), with no CISA KEV listing - consistent with a low real-world exploitation risk despite the High availability impact assigned by CVSS.
Out-of-bounds read in the Linux kernel's ALSA USB MIDI subsystem (`snd_usbmidi_get_ms_info()`) allows a local attacker to trigger a kernel panic and denial of service by presenting a crafted USB MIDI device with a malformed endpoint descriptor `bLength` field. The descriptor walker fails to verify that `bLength` stays within the remaining endpoint-extra scan bytes, leaving flexible-array reads of `baAssocJackID[]` potentially unbounded by the actual buffer limit. No public exploit is identified at time of analysis, and EPSS places exploitation probability at 0.18% (8th percentile), consistent with the local attack vector.
Arbitrary file write in TortoiseGit's TortoiseGitBlame component is triggered when a user opens a malicious git repository and invokes blame history on a file whose historical filenames contain argument injection payloads. The injected arguments are passed unsanitized to underlying git subprocess calls, allowing an attacker-controlled repository to write files to arbitrary paths on the victim's Windows filesystem. No public exploit has been identified at time of analysis, and no KEV listing exists; however, a fix commit is available upstream.
Kernel panic via RCU locking imbalance in the DRBD subsystem's drbd_adm_dump_devices() function affects Linux kernel versions from the introduction of commit a55bbd375d18 through multiple stable branches. A locally authenticated low-privilege user who can invoke DRBD administrative operations may trigger a kernel crash by exploiting the unbalanced rcu_read_unlock() call - called without a preceding rcu_read_lock() - leading to a denial-of-service via kernel instability. No public exploit exists and EPSS probability is 0.18% (8th percentile), indicating very low real-world exploitation activity.
Write operation hang in the Linux kernel dm-cache subsystem's passthrough mode allows a local user with low privileges to stall I/O indefinitely on affected block devices. The defect lies in `invalidate_remove()`, which configures a remapped bio for submission to the cache origin but discards it without dispatching, leaving write operations permanently pending. No public exploit has been identified at time of analysis; EPSS at 0.18% (8th percentile) and a strictly local attack vector place this firmly in the operational-bug category rather than an active threat.
Instability and system crash vulnerability in the Linux kernel's Qualcomm DRM/MSM Display Processing Unit (DPU) driver allows a local low-privileged attacker to trigger a voltage-clock mismatch that causes the MMCX power rail to fall to MIN_SVS while the DPU core clock remains at its maximum frequency. This race condition between power management and clock control during runtime suspend/resume can leave the hardware in an unsustainable electrical state, leading to display subsystem failure or kernel panic. No public exploit identified at time of analysis; EPSS of 0.18% reflects the hardware-specific, local-only nature of this flaw.
Null pointer dereference in the Linux kernel's BPF sockmap subsystem allows a local low-privileged user to crash the system via a race condition between AF_UNIX socket connection and sockmap proto update. The flaw exists because unix_stream_connect() sets sk_state to TCP_ESTABLISHED before assigning the peer pointer, creating a window where unix_stream_bpf_update_proto() dereferences unix_peer(sk) while it is still NULL. No public exploit exists and EPSS sits at the 8th percentile; this is not in CISA KEV, and the narrow race window constrains practical exploitation.
Integer overflow in the Linux kernel's AF_ALG socket interface (crypto/af_alg.c) lets a local user supply an oversized AEAD associated-data length that wraps during TX buffer size arithmetic, corrupting size checks; the fix caps AD length to 0x80000000. Carrying CVSS 7.0 (AV:L/AC:H/PR:L), it affects any kernel exposing the algif AEAD interface and threatens confidentiality, integrity, and availability through resulting memory corruption. There is no public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile), consistent with a local-only, high-complexity issue.
Deadlock in the Linux kernel btrfs filesystem subsystem triggers an unrecoverable kernel hang when the flushoncommit mount option is active and a reflink operation copies an inline extent to a destination offset beyond the target inode's i_size. The circular wait arises because the reflink task holds the extent io tree lock while blocking on a pending transaction commit, while the commit's delalloc flush simultaneously blocks trying to acquire that same held lock. No public exploit or CISA KEV listing exists; EPSS is 0.18% (8th percentile), reflecting very low real-world exploitation interest.
Stack exhaustion in the Linux kernel batman-adv mesh networking subsystem allows an attacker on the same batman-adv mesh to crash the kernel by sending matryoshka-nested BATADV_UNICAST_FRAG packets. The reassembled payload's packet type is not validated before re-processing, enabling unbounded recursion in batadv_batman_skb_recv() that exhausts kernel stack and causes a hard system crash. No active exploitation is recorded in CISA KEV and EPSS sits at 0.18% (7th percentile), making this a targeted DoS risk limited to environments running batman-adv mesh networking.
Null pointer dereference in the Linux kernel's BPF LWT (Lightweight Tunnel) subsystem allows a local user with BPF syscall privileges to crash the kernel via a denial-of-service. The flaw exists because bpf_prog_test_run_skb constructs a socket buffer (skb) without initializing skb->_skb_refdst; when a BPF program invokes the bpf_lwt_xmit_push_encap helper through this test path, the subsequent dereference of skb_dst(skb)->dev hits a null pointer and triggers a kernel panic. No public exploit or CISA KEV listing exists, and EPSS is very low at 0.18% (7th percentile), consistent with the specialized access required.
Error pointer dereference in the Linux kernel's brcmfmac Broadcom WiFi driver allows a local low-privilege attacker to crash the kernel via a NULL pointer dereference, resulting in denial of service. The function brcmf_chip_add_core() in brcmf_chip_recognition() can return an ERR_PTR sentinel value that is never validated before being dereferenced at five separate code sites (lines 1010-1022 of chip.c), as identified by Smatch static analysis. No public exploit or active exploitation has been identified; EPSS sits at 0.18% (7th percentile), consistent with a low-priority local DoS affecting only systems with Broadcom WiFi hardware.
NULL pointer dereference in the Linux kernel dm-cache subsystem crashes the kernel when concurrent writes target the same cached block in passthrough mode. The flaw affects any kernel with a dm-cache device explicitly configured in passthrough mode since version 4.12, allowing a local low-privileged user with write access to the block device to cause a kernel panic and complete denial of service. No public exploit code exists and EPSS at 0.18% (7th percentile) confirms very low exploitation probability; fixed across multiple stable kernel series with patches confirmed by Ubuntu security advisories.
Data loss in the Linux kernel dm-cache subsystem occurs when LVM's table preload feature is used to switch a writeback cache to passthrough mode while dirty mappings exist. The dirty mapping check was designed assuming table reloads happen only after device suspension (which flushes dirty blocks), but LVM's preload path bypasses this assumption, allowing dirty cache blocks to be silently loaded into passthrough mode where they will never be written back to the origin device. No public exploit code exists; reproduction requires a deliberate sequence of dmsetup and fio operations documented in the CVE description itself. EPSS is 0.18% (7th percentile), consistent with a local, configuration-specific data-loss condition rather than a remotely exploitable flaw.
Kernel panic via reachable assertion in the OCFS2 cluster filesystem allows a local, low-privileged user to crash the system by issuing a crafted OCFS2_IOC_GROUP_ADD ioctl. The root cause is that ocfs2_group_add() invokes ocfs2_set_new_buffer_uptodate() on a user-supplied group block number before ocfs2_verify_group_and_input() has validated that number; if the block already exists in the metadata cache, the BUG_ON at uptodate.c:509 fires unconditionally, triggering a kernel oops. No public exploit has been identified and EPSS is 0.18% (7th percentile), but the fix is widely available across maintained stable branches.
Deadlock in the Linux kernel's usbhid driver (`hid_post_reset()`) can halt systems connected to composite USB devices that combine HID and block storage or UAS components. When such a device undergoes a reset during block IO error handling, memory allocations using the default GFP_KERNEL flag can trigger block IO reclaim, which deadlocks against the mutex already held by the reset path - producing a kernel hang. No public exploit has been identified, and EPSS of 0.18% (7th percentile) confirms very low exploitation likelihood; the fix replaces GFP_KERNEL with GFP_NOIO across all affected reset callbacks, and patches are available across multiple Linux stable branches.
Integer overflow in the Linux kernel SCSI target core allows a local attacker with low privileges to crash the kernel via crafted UNMAP commands. The `sbc_execute_unmap()` function performs a capacity bounds check on LBA + range but fails to guard against 64-bit wraparound, meaning an attacker can supply values that overflow to bypass the check and trigger a kernel panic. No public exploit code or CISA KEV listing exists; EPSS is 0.18% (7th percentile), reflecting the niche attack surface limited to systems actively running SCSI target daemons. Patches are confirmed available across all supported stable kernel branches.
Denial of service in the Linux kernel's netfilter xtables subsystem exposes systems to local kernel panics caused by using inet-specific match extensions (xt_mac, xt_owner, xt_physdev, xt_realm) in incompatible protocol family contexts such as ebtables. The flaw was introduced by commit ab4f21e6fb1c, which broadened these extensions to NFPROTO_UNSPEC, inadvertently permitting their use in Ethernet bridge filtering contexts where IPv4-specific kernel data structures (e.g., dst->tclassid for xt_realm) are undefined or null. No public exploit has been identified and EPSS is 0.18% at the 7th percentile, indicating low adversarial interest despite the ubiquitous deployment footprint of the Linux kernel.
Stack memory disclosure in the Linux kernel RDS/IB subsystem exposes up to 26 bytes of uninitialized kernel stack contents - including kernel text and data pointers - to local unprivileged users via the getsockopt(SOL_RDS, RDS_INFO_IB_CONNECTIONS) interface. The leak enables KASLR bypass on systems where the kernel was built without CONFIG_INIT_STACK_ALL_ZERO=y, making this a useful primitive for chaining into privilege escalation. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS is very low at 0.18% (7th percentile), but the CVE description itself supplies a complete, step-by-step reproduction recipe that reduces practical exploitation complexity to near-trivial for any local user with AF_RDS socket access.
Uninitialized memory use in the Linux kernel netdevsim subsystem allows a local low-privileged attacker to cause kernel crashes or potentially expose residual kernel heap contents via dummy packet trap operations. The root defect is in `nsim_dev_trap_skb_build`, where `skb_put` allocated space for a `struct iphdr` without zeroing it, leaving uninitialized kernel memory accessible in a dummy `sk_buff`. No public exploit code exists and the vulnerability is not in CISA KEV; EPSS stands at 0.18% (7th percentile), consistent with negligible opportunistic exploitation risk. Vendor-released patches are confirmed across all actively supported stable kernel branches.
NULL pointer dereference in the Linux kernel's batman-adv OGMv2 subsystem allows a local low-privilege user to crash the kernel by racing interface teardown against OGM dispatch. When a batman-adv hard interface is disabled and its mesh_iface pointer is set to NULL, the batadv_v_ogm_queue_on_if() function continues to call netdev_priv() on that NULL pointer, triggering a kernel panic. No public exploit exists and EPSS is 0.18% (7th percentile), making this low operational priority except on systems actively running batman-adv mesh networking.
Operation sequencing flaw in the Linux kernel's tegra194 PCIe endpoint driver causes a Control Backbone (CBB) timeout when PERST# is deasserted twice in succession. During the second deassert cycle, the driver invokes pci_epc_deinit_notify() and dw_pcie_ep_cleanup() - which access DBI register PCIE_MISC_CONTROL_1_OFF at offset 0x8bc - before reset_control_deassert() powers on the PCIe controller core, triggering a hardware bus timeout and denying availability of the PCIe subsystem. With an EPSS of 0.18% (7th percentile), no CISA KEV listing, and hardware-specific scope limited to NVIDIA Tegra194 SoCs, this is a low-probability exploitation target with real-world impact confined to embedded and automotive Linux deployments.
Resource leak in the Linux kernel fsnotify subsystem causes hung tasks and local denial of service via a race condition in fsnotify_recalc_mask(). A local low-privilege user can trigger concurrent mark addition and removal on a filesystem connector object, causing an inode pointer returned by __fsnotify_recalc_mask() to be silently discarded rather than released via fsnotify_drop_object() - permanently blocking the umount path as fsnotify_sb_delete() waits indefinitely on the leaked reference. No public exploit exists and EPSS is at the 7th percentile, indicating negligible opportunistic exploitation risk.
Out-of-bounds descriptor read in the Linux kernel ALSA USB MIDI 2.0 subsystem allows a physically proximate or low-privileged local attacker to crash the kernel by presenting a malformed USB audio device with crafted MIDI 2.0 endpoint descriptors. The USB MIDI 2.0 endpoint parser validates bLength against bNumGrpTrmBlock but omits validation against remaining bytes in the endpoint-extra scan, allowing baAssoGrpTrmBlkID[] reads to advance past the descriptor buffer boundary. No public exploit is identified; EPSS stands at 0.18% (7th percentile), consistent with narrow, hardware-dependent attack surface and no active exploitation.
NULL pointer dereference in the Linux kernel's sch_dualpi2 queuing discipline (net/sched) allows a local attacker with low privileges to crash the kernel, causing a denial of service. The flaw exists in dualpi2_change(), which enforces updated queue limits after a qdisc reconfiguration: when traffic is exclusively queued in the L-queue and the C-queue is empty, the function unconditionally dereferences the NULL skb returned by the C-queue dequeue path, triggering a kernel panic. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), consistent with a locally-triggered, configuration-dependent kernel bug.
Improper RLIMIT_MEMLOCK accounting in the Linux kernel's vsock/virtio MSG_ZEROCOPY path allows a local low-privileged user to bypass per-process pinned-page limits, enabling unbounded kernel memory pinning that can drive the system toward memory exhaustion. The flaw is confined to the virtio vsock transport and is not remotely exploitable. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), reflecting low exploitation interest; however, a vendor-confirmed fix is available in stable releases.
Missing CAP_NET_ADMIN enforcement in the Linux kernel PSP (PSP Security Protocol) netlink subsystem allows any local user with low privileges within the same network namespace to invoke the dev-set and key-rotate operations - modifying PSP version configuration and rotating cryptographic key material without authorization. The only access control in place, psp_dev_check_access(), validates only network namespace membership and does not enforce administrative capability. This enables unauthorized disruption of PSP-encrypted network communications and unauthorized modification of in-use cryptographic keying material. No public exploit code has been identified at time of analysis, and EPSS exploitation probability is very low at 0.17% (7th percentile).
NULL pointer dereference in the Linux kernel's Traffic Control cls_fw (firewall classifier) module causes a local denial of service via kernel crash. Affected kernels from commit ed76f5edccc9 onward publish TC filters to the shared datapath block before the ->change() validation function runs; an attacker with CAP_NET_ADMIN who adds an invalid 'old-style' cls_fw filter to a shared block can trigger fw_classify() to dereference a NULL 'q->handle' pointer when live traffic hits the unvalidated filter. No public exploit or KEV listing exists at time of analysis, and EPSS sits at the 7th percentile (0.17%), consistent with a kernel-local, capability-gated DoS.
Null pointer dereference in the Linux kernel Bluetooth HCI UART line discipline driver (hci_ldisc) allows local low-privileged users on systems with UART-attached Bluetooth hardware to crash the kernel, causing denial of service. The flaw spans multiple stable kernel branches from 5.4.x through 6.15 and stems from a missing flag clear in the error path of hci_uart_register_dev(). No public exploit code exists and EPSS sits at the 7th percentile (0.17%), indicating low real-world exploitation probability; patched versions are available across all affected stable branches.
Resource leak in the Linux kernel ASoC STI audio driver allows a local authenticated user to exhaust kernel memory by repeatedly loading and unloading the driver, degrading system availability. The vulnerability stems from regmap_field objects allocated during STI audio player initialization never being released on driver removal. With EPSS at 0.17% (7th percentile), no KEV listing, and no public exploit, this is a low-priority maintenance fix rather than an actively weaponizable flaw. Vendor-released patches are available across multiple stable kernel branches.
Incorrect memory access in the Linux kernel's ASoC Qualcomm QDSP6 audio topology driver can trigger a kernel panic on affected Qualcomm Snapdragon hardware when virtual DAPM widgets are processed without a type guard. The flaw, introduced at commit 36ad9bf1d93d66b901342eab9f8ed6c1537655a6, affects kernel branches from 5.16 onward until the respective stable fixes. No active exploitation has been identified (not in CISA KEV) and the EPSS score of 0.17% (7th percentile) reflects negligible real-world exploitation probability; hardware dependency further constrains the affected population.
NULL pointer dereference in the GFS2 filesystem's log release path crashes the Linux kernel during unmount on affected versions. The vulnerability arises because gfs2_log_release() dereferences sdp->sd_jdesc without checking for NULL, which can occur after the journal descriptor has already been freed during the unmount sequence. A prior fix (commit 35264909e9d1) addressed the same class of bug in gfs2_log_flush() but left gfs2_log_release() unprotected. No public exploit exists (EPSS 0.17%), exploitation is limited to local access on GFS2-mounted systems, and patches are available across all affected stable kernel branches.
The Linux kernel's BPF sockmap subsystem deadlocks when a BPF iterator program iterating over AF_UNIX sockets via `bpf_iter_unix_seq_show()` simultaneously attempts to update a sockmap entry during the same execution context. When `lock_sock_fast()` takes the spinlock fast path and holds `slock-AF_UNIX`, any subsequent `sock_map_update_elem()` call within the BPF iterator program spins indefinitely attempting to re-acquire the same spinlock on the same CPU, causing an unrecoverable kernel deadlock and loss of system availability. This is not confirmed actively exploited (not in CISA KEV), no public exploit has been identified, and EPSS at 0.17% (7th percentile) confirms negligible current exploitation interest; the real-world risk is constrained to specialized BPF workloads with specific capability requirements.
Uninitialized variable read in the NTFS3 filesystem driver (`ntfs_iomap_begin()`) of the Linux kernel allows a local authenticated user to crash the system by triggering a zero-length run condition that causes the `lcn` (logical cluster number) variable to be consumed before assignment. The flaw affects Linux 7.0 up to 7.0.10 and Linux 7.1 prior to the stable fix commits, with the defect discovered and confirmed by Google syzbot via KMSAN. No public exploit has been identified and EPSS probability is very low (0.17%, 7th percentile); patches are available in Linux 7.0.10 and 7.1.
Missing NUL termination in the Linux kernel's ntfs3 filesystem driver allows a local attacker with filesystem mount privileges to trigger an out-of-bounds memory read, crashing the kernel. The defect in ntfs_fill_super() leaves sbi->volume.label unterminated when a UTF-16 volume label converts to a UTF-8 string that exactly fills the fixed buffer, causing ntfs3_label_show() to read past the buffer boundary via a %s format specifier. No public exploit has been identified at time of analysis and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation interest despite the High availability impact in CVSS.
Unbounded string concatenation in the Linux kernel's Dell WMI BIOS interface driver (dell-wmi-sysman) allows a local low-privileged attacker on Dell hardware to crash the kernel. The populate_enum_data() function bounds each individual firmware-provided string but applies no remaining-space check during cumulative strcat() calls into fixed 512-byte struct members, enabling a buffer overflow that results in complete system availability loss. With an EPSS of 0.17% (7th percentile), no public exploit code, and no CISA KEV listing, this is a low-likelihood but straightforward local denial-of-service on Dell platforms running unpatched kernel versions.
Livelock in the Linux kernel's futex requeue-PI subsystem can hang a system when a signal or timeout interrupts a FUTEX_WAIT_REQUEUE_PI operation concurrently with an active FUTEX_CQ_REQUEUE_PI requeue. The race causes a waiting thread (Task A) to block indefinitely on a hash-bucket lock while a requeue thread (Task B) busy-loops retrying the same operation, consuming all available CPU - worst-case on uniprocessor systems where Task A cannot be scheduled at all. No public exploit is identified and EPSS is 0.17% (7th percentile), but the deterministic nature of the livelock on UP or real-time-scheduled hardware makes this a genuine denial-of-service risk; patches are available across six Linux stable branches.
Deadlock in the Linux kernel's md/raid456 subsystem during array reshape allows a local low-privileged user to hang the system indefinitely. When direct I/O spans the reshape position in a RAID 4/5/6 array, the I/O blocks in raid5_make_request() holding an active_io reference while waiting for reshape progress. If an administrator concurrently freezes the reshape and writes to md/suspend_lo or md/suspend_hi, mddev_suspend() deadlocks: it waits for active_io to drain, but the blocked I/O requires reshape progress that the frozen reshape thread can never provide. Exploitation requires a very specific confluence of conditions and no public exploit code or active exploitation (CISA KEV) has been identified; EPSS at 0.17% (7th percentile) confirms low real-world exploitation probability.
Improper locking in the Linux kernel's md (Multiple Devices/software RAID) subsystem causes a recursive kobject teardown deadlock when 'clear' is written to the sysfs array_state attribute. A local user with write access to an active md array's sysfs interface can trigger a kernel denial-of-service by exploiting the incorrect ordering of mddev_put() before sysfs_unbreak_active_protection() in md_attr_store(). No public exploit code is identified and EPSS exploitation probability is minimal at 0.17% (7th percentile); no CISA KEV listing indicates active exploitation has not been confirmed.
NULL pointer dereference in the Linux kernel's MediaTek mt76/mt7925 WiFi driver crashes affected systems when the `vif` (virtual interface) pointer is uninitialized at the time `mt7925_mac_write_txwi` calls `ieee80211_vif_is_mld(vif)`. Local low-privilege users on systems equipped with mt7925 hardware and running unpatched kernels can trigger a kernel panic, resulting in a denial of service. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.17% (6th percentile) reflects negligible real-world exploitation probability at this time.
NULL pointer dereference in the Linux kernel's DRM Cadence MHDP8546 DisplayPort bridge driver (cdns-mhdp8546-core) can be triggered by a local low-privileged user on systems with the affected hardware, causing a kernel panic and complete system availability loss. The flaw arises when error recovery paths in cdns_mhdp_modeset_retry_fn() attempt to access a mutex via a connector pointer that has not yet been initialized in the DRM_BRIDGE_ATTACH_NO_CONNECTOR code path. No public exploit code or active exploitation (CISA KEV) has been identified; patches are available across multiple stable kernel branches.
Out-of-bounds read in the Linux kernel's IMA (Integrity Measurement Architecture) filesystem subsystem causes a kernel panic during boot on systems with TPM chips advertising hash algorithms unsupported by the kernel. Specifically, when `ima_tpm_chip->allocated_banks[i].crypto_id` is set to the sentinel `HASH_ALGO__LAST` for an unmapped TPM algorithm (demonstrated with TPM_ALG_SHA3_256 = 0x0027), the `create_securityfs_measurement_lists` function dereferences the out-of-range index into `hash_algo_name[]`, triggering a KASAN-detected global-out-of-bounds read and kernel crash. No public exploit has been identified and EPSS is 0.17% (6th percentile), making deliberate exploitation unlikely; the primary risk is inadvertent boot-time denial of service on hardware with qualifying TPM chips.