NULL pointer dereference in the Linux kernel's BPF verifier crashes the kernel when a scalar register is stored into a kptr map slot during BPF program loading. Introduced by commit ab6c637ad027, which refactored map_kptr_match_type() to call btf_is_kernel(reg->btf) before the guard that excludes non-BTF register types - exposing scalar registers (reg->btf == NULL) to an immediate NULL dereference. A local user with BPF syscall access can trigger a kernel panic, producing a denial of service. No active exploitation is confirmed (not in CISA KEV), and EPSS is low at 0.17% (6th percentile), consistent with the local-only, DoS-limited impact.
Integer truncation in the Linux kernel's EROFS filesystem driver on 32-bit platforms causes logical cluster number (LCN) calculations to overflow at the 4 GiB boundary, resulting in incorrect block addressing and potential kernel-level availability impact. Affected systems are those running 32-bit Linux kernels (where `unsigned long` is 32 bits wide) with EROFS filesystems mounted. No public exploit exists and no active exploitation has been confirmed; EPSS stands at a very low 0.17% (6th percentile), consistent with the niche attack surface of 32-bit deployments.
Kernel panic via skb headroom exhaustion in the Linux kernel's Traffic Control (TC) act_mirred subsystem affects systems using block-cast packet redirection across mixed device types. The root cause is a copy-paste error in tcf_blockcast_redir() where dev_is_mac_header_xmit() is queried against the next device in the iteration (dev) rather than the device currently being transmitted to (dev_prev), causing tcf_mirred_to_dev() to make wrong MAC header push/pull decisions for intermediate devices. In the worst case, skb_push_rcsum is called with an incorrect mac_len, exhausting socket buffer headroom and triggering a kernel panic. No public exploit code has been identified and EPSS is 0.17% at the 6th percentile, consistent with low real-world exploitation interest.
Denial-of-service in the Linux kernel macvlan driver allows local users with network interface management privileges to crash netlink interface dumps by exploiting a missing netlink buffer size reservation for the IFLA_MACVLAN_BC_CUTOFF attribute. When bc_cutoff is set to any value other than the default (1) on a macvlan bridge interface, any subsequent attempt to dump that interface via GETLINK triggers nla_put_s32() to return -EMSGSIZE, fires a WARN_ON in rtnetlink, and prevents the interface from being enumerated. No public exploit tool has been identified and no active exploitation is confirmed; EPSS is 0.17% (6th percentile).
Kernel crash via scheduler state corruption in the Linux kernel's CFS/EEVDF fair scheduler allows a local user to cause a NULL pointer dereference and system denial of service. When a task is forked while the parent's sched_entity has rel_deadline set, the child inherits stale deadline state that __sched_fork() fails to clear; a subsequent sched_yield() call on the child inflates vruntime by approximately 2x (observed: ~9.8e15 jumping to ~1.9e16), corrupting cfs_rq->sum_w_vruntime and ultimately causing pick_next_entity() to return NULL unexpectedly. No active exploitation has been identified (EPSS 0.17%, not in CISA KEV), and upstream stable patches are available across multiple kernel branches.
An infinite loop condition in the Linux kernel's DRM/TTM GPU memory management subsystem allows a local unprivileged user to cause a system-level denial of service. When `ttm_bo_swapout()` encounters a swapout failure, the error recovery path incorrectly repositions the buffer object at the tail of the LRU list - placing it ahead of the walk cursor's hitch node - so the subsequent `list_for_each_entry_continue()` repeatedly processes the same resource indefinitely, hanging the kernel's memory reclaim path. No public exploit has been identified and EPSS probability is 0.17% (6th percentile), but the stable kernel patch is confirmed available via two upstream commits.
Memory exhaustion in the Linux kernel mt76 WiFi driver allows a local low-privileged user on systems with MediaTek MT76 hardware to cause denial of service through kernel memory leakage during module teardown. The mt76_dma_cleanup routine fails to destroy page_pools associated with WED RRO receive queues (queues not tied to NAPI), and does not return pages to the pool when WED is not enabled - resulting in unreclaimed kernel memory on each module unload cycle. No public exploit exists and EPSS probability sits at 0.17% (6th percentile), consistent with a niche hardware-specific leak with no code-execution path.
Deadlock in the Linux kernel's mt76/mt7925 MediaTek WiFi driver can be triggered by a local low-privileged user, causing the wireless networking subsystem to hang indefinitely. The flaw exists in mt7925_roc_abort_sync(), which calls cancel_work_sync() while already holding dev->mt76.mutex - the same mutex held by roc_work() - producing a classic mutual-wait deadlock with no path to resolution. Systems running affected kernel versions with MediaTek MT7925 WiFi hardware are vulnerable to a local denial of service; no public exploit has been identified and EPSS places exploitation probability at 0.17% (6th percentile), consistent with the niche hardware requirement.
Mutex deadlock in the Linux kernel's mt7921 WiFi driver (mt76/mt7921 subsystem) can render the WiFi subsystem permanently unresponsive on affected systems. The deadlock arises during station removal: the call chain mt76_sta_state() → mt76_sta_remove() → mt7921_mac_sta_remove() → mt7921_roc_abort_sync() invokes cancel_work_sync() while roc_work() holds dev->mt76.mutex and the removal path already owns the same lock - a classic ABBA deadlock with no progress possible. No public exploit is identified and EPSS sits at 0.17% (6th percentile), placing this firmly in the patch-and-move-on category for most organisations, though Linux distributions serving MT7921 hardware (common in consumer laptops) should prioritise kernel updates.
Deadlock in the Linux kernel mt76 WiFi driver's remain-on-channel path allows a local low-privileged user to crash or hang the WiFi subsystem. The flaw affects kernels containing the mt76 driver from commit a8f424c128 through the fixed releases (6.18.33, 7.0.10, 7.1), with no confidentiality or integrity impact - only availability. No public exploit code exists and EPSS sits at 0.17% (6th percentile), consistent with a local, hardware-specific denial-of-service with negligible opportunistic exploitation risk.
BPF subsystem argument-tampering in the Linux kernel allows local attackers with CAP_BPF privileges to abuse the kprobe+freplace program chaining path to overwrite kernel function arguments via a manipulated `struct pt_regs`, causing kernel denial of service or subversion of kernel function behavior. The root mechanism is that freplace programs inherit the `kprobe_write_ctx=true` permission from a parent kprobe program, enabling register writes that should be confined to uprobe contexts. No public exploit or CISA KEV listing is confirmed; EPSS sits at the 6th percentile. Patches are available in Linux 6.18.33, 7.0.10, and the 7.1 mainline branch.
NULL pointer dereference in the Linux kernel's fwctl subsystem allows a local low-privilege user to crash the kernel when CXL memory expansion hardware is present and a device removal is triggered. The defect stems from a deterministic module initialization ordering race between the CXL and fwctl drivers, leaving knode_class uninitialized at device registration time and causing device_del() to dereference it fatally on removal. No public exploit identified at time of analysis; EPSS of 0.17% (6th percentile) reflects very low exploitation probability consistent with the local-only attack surface.
Memory leak in the Linux kernel's Renesas i3c master driver causes local denial of service through kernel memory exhaustion. Specifically, the xfer structure allocated by renesas_i3c_alloc_xfer() inside renesas_i3c_i3c_xfers() is never released, allowing a local user with low privileges on affected Renesas SoC hardware to exhaust kernel memory by repeatedly triggering i3c transfers. No public exploit has been identified at time of analysis, and EPSS probability sits at 0.17% (6th percentile), reflecting low real-world exploitation interest.
Error pointer dereference in the Linux kernel USB Type-C TI Power Delivery (tipd) driver allows a local low-privileged user to crash the kernel (denial of service) on systems with TI CD321x or TPS6598x USB Type-C controller hardware. The flaw in `cd321x_update_work()` at `drivers/usb/typec/tipd/core.c:827` logs a warning when `typec_register_partner()` fails but omits an early return, causing a subsequent unconditional dereference of the error pointer via `typec_partner_set_identity()`. No public exploit code has been identified at time of analysis, EPSS probability is 0.17% (6th percentile), and the vulnerability is not listed in CISA KEV.
Kernel panic in the SpaceMIT clock controller driver (`clk-spacemit-ccu`) can be triggered during CPU frequency scaling on systems running SpaceMIT RISC-V hardware. The root cause is an inverted boolean condition in `ccu_mix_trigger_fc()` that causes the frequency change trigger to be skipped at the wrong time and fired at the wrong time, crashing the kernel under normal cpufreq governor activity. Exploitation requires only local low-privilege access, but is practically limited to the narrow hardware footprint of SpaceMIT K1-based boards; no public exploit or CISA KEV listing exists, and EPSS is 0.17% (6th percentile).
Kernel panic in the Linux f2fs garbage collector allows a local low-privileged user to crash the system by triggering a VM_BUG_ON_FOLIO assertion when GC attempts to re-read a page already marked uptodate after multiple block relocations. The affected subsystem is f2fs (Flash-Friendly File System); systems using ext4, XFS, or other filesystems are not impacted. EPSS is extremely low (0.17%, 6th percentile) and no active exploitation has been identified, making this a stability/DoS concern primarily relevant to mobile, embedded, and flash-storage Linux deployments.
Race condition in the Linux kernel PSP network subsystem allows a local low-privileged attacker to crash the kernel through a TOCTOU flaw in device association creation. In `psp_assoc_device_get_locked()`, a device reference acquired under RCU becomes stale before the protecting lock is taken if `psp_dev_unregister()` completes concurrently, leaving the kernel operating on freed or invalid device state. No public exploit has been identified and EPSS stands at 0.17% (6th percentile), reflecting minimal active exploitation risk despite the well-characterized code-level race condition.
Race condition in the Linux kernel's System V IPC shared memory subsystem allows a local low-privileged attacker to crash the kernel. The `shm_destroy_orphaned()` cleanup path evaluates whether an orphaned segment is safe to destroy by checking `shm_nattch` without holding `shm_perm.lock`, while the attach/detach paths update that counter independently of `shm_ids(ns).rwsem`, creating a window where a still-attached segment is erroneously destroyed. The EPSS score is 0.17% (6th percentile) and no KEV listing or public exploit exists, placing this firmly in the routine-patching tier rather than emergency response.
Uninitialized memory read in the Linux kernel's hamradio 6pack TTY driver (net/hamradio/6pack.c) allows a local low-privileged user to crash the kernel, causing a denial of service. The flaw exists across a broad range of stable kernel branches from 2.6.12 through at least 7.0, and patches have been issued across eight stable series. No public exploit code exists and no active exploitation has been reported; with an EPSS of 0.16% at the 6th percentile, real-world risk is constrained by the highly niche deployment context of amateur-radio 6pack hardware.
Out-of-bounds read in the Linux kernel's BPF test interface (bpf_prog_test_run_skb) allows local users with BPF syscall access to crash the kernel by supplying a crafted test packet containing only an Ethernet header bearing an IPv4 or IPv6 EtherType but no L3 payload. The code calls eth_type_trans() to set skb->protocol and then unconditionally dereferences ip_hdr(skb) or ipv6_hdr(skb) without first validating that the supplied buffer is large enough to contain an IP or IPv6 header, producing a kernel panic. Patched stable releases are confirmed across eight kernel branches; no public exploit or CISA KEV listing exists, and EPSS probability is 0.16% (6th percentile).
NULL pointer dereference in the Linux kernel SMC subsystem's smc_msg_event tracepoint crashes the kernel when SMC-D socket traffic is processed while the tracepoint is active. Affected kernels from commit aff3083f10bff7a37eaa2b4e6bc5fb627ddd5f84 across multiple stable branches dereference conn->lnk unconditionally in the tracepoint, though this pointer is only valid for SMC-R connections and is NULL for SMC-D. While activating the tracepoint requires root, the crash itself can be triggered by any unprivileged user via AF_SMC socket operations on SMC-D capable systems (s390 natively, or x86 with loopback ISM loaded). No public exploit or active exploitation confirmed; EPSS sits at 0.16%.
NULL pointer dereference in the Linux kernel RDS/InfiniBand subsystem allows an unprivileged local user to trigger a kernel panic by sending an atomic cmsg over an active RDS/IB connection. The completion handler rds_ib_send_unmap_op() lacks switch cases for masked atomic opcodes (IB_WR_MASKED_ATOMIC_CMP_AND_SWP, IB_WR_MASKED_ATOMIC_FETCH_AND_ADD), returning rm=NULL while the send operation remains flagged, leading to a fatal NULL dereference at rm->m_final_op in softirq context. No public exploit has been identified and EPSS is 0.16% (6th percentile), but the crash is deterministic and reproducible on any system with mlx4/mlx5 InfiniBand hardware running an unpatched kernel with active RDS/IB connections.
Stale gateway pointer in the Linux kernel's batman-adv mesh networking subsystem causes availability failures during mesh teardown and recreation. The batman-adv gateway cleanup function `batadv_gw_node_free()` frees gateway list entries without clearing `bat_priv->gw.curr_gw`, leaving a dangling reference that persists across cleanup and breaks subsequent mesh recreation attempts. No public exploit exists and EPSS sits at 0.16% (6th percentile), indicating negligible opportunistic exploitation interest at time of analysis.
NULL pointer dereference in the Linux kernel VRF (Virtual Routing and Forwarding) subsystem allows a local low-privileged user to crash the kernel via a race condition between RCU readers and VRF port removal operations, resulting in a complete denial of service on affected systems. Systems using VRF network segmentation are at risk specifically when VRF port membership is dynamically modified concurrent with socket bind() operations. EPSS is 0.16% (6th percentile) and the vulnerability is not listed in CISA KEV; no public exploit code has been identified, but patched kernel versions are available across all active stable branches.
Denial of service in the Linux kernel netfilter ipset subsystem allows a local low-privileged user to disrupt availability by triggering an iterator overrun in hash:ip,mark, hash:ip,port, hash:ip,port,ip, or hash:ip,port,net set types during IPv4 range iteration. The 32-bit loop iterator is not properly bounded, allowing it to advance past the last address in the requested range; subsequent retry passes then resume from an unintended position, corrupting traversal state. No public exploit is identified at time of analysis, and the EPSS score of 0.16% (6th percentile) confirms very low exploitation probability, making this a routine patching priority rather than an emergency response.
Data loss in the Linux kernel's f2fs (Flash-Friendly File System) driver exposes files created and synced before any checkpoint has been written to permanent loss on sudden power off. The race condition between fsync on newly created files and concurrent checkpoint operations causes f2fs_need_inode_block_update() to misread prematurely set nat_entry flags (IS_CHECKPOINTED and HAS_LAST_FSYNC), leading fsync to skip the inode block flush it actually requires. No public exploit identified at time of analysis; the EPSS score of 0.16% at the 6th percentile reflects the narrow triggering conditions and local-only attack surface.
Infinite LRU list traversal in the Linux kernel's drm/ttm memory management subsystem allows a local low-privileged user to cause a kernel hang or denial of service on GPU-equipped systems. The flaw resides in ttm_bo_shrink(), where the bulk-move removal step was executed before confirming successful buffer object backup, leaving the LRU list in a corrupted state that loops indefinitely on backup failure. Notably, the 'Information Disclosure' tag in source intelligence conflicts with the CVSS C:N metric - the actual impact is availability only. No public exploit code has been identified, and EPSS exploitation probability is very low at 0.16% (6th percentile).
Kernel panic via unchecked error pointer dereference in the Linux kernel's drm/sun4i display backend driver affects Allwinner SoC-based systems running kernel versions from 4.17 up to the patched releases. In sun4i_backend_atomic_check() at drivers/gpu/drm/sun4i/sun4i_backend.c:496, the return value of drm_atomic_get_plane_state() is not validated against IS_ERR() before dereference, allowing a local low-privilege user to crash the kernel. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.16% (6th percentile) reflects negligible real-world exploitation interest.
Memory leaks in the Linux kernel's ath11k Wi-Fi driver (Qualcomm 802.11ax/Wi-Fi 6) expose systems to local availability-only denial-of-service via kernel memory exhaustion. The affected functions ath11k_mac_setup_bcn_tmpl_ema() and ath11k_mac_setup_bcn_tmpl_mbssid() fail to release allocated beacon template memory when error conditions occur in parameter setup, causing incremental heap exhaustion. With EPSS at 0.16% (5th percentile), no public exploit, and no CISA KEV listing, this is a low-urgency fix discovered through static analysis - not active exploitation.
Reference leak in the Linux kernel blk-cgroup subsystem allows a local low-privileged user to cause kernel disk object memory exhaustion, potentially leading to system instability or denial of service. The flaw exists in blkcg_maybe_throttle_current() since kernel 6.3, where a missing put_disk() call on error paths leaves disk references permanently unreleased. No public exploit exists and EPSS at 0.16% (5th percentile) indicates negligible exploitation probability; patches are available across multiple stable branches.
Kernel memory exhaustion in the Linux mt76 WiFi driver allows a local low-privileged user on affected hardware to gradually degrade system availability. The functions mt76_connac_mcu_sta_wed_update() and mt76_connac_mcu_sta_key_tlv() may fail before the allocated socket buffer (skb) is handed off to mt76_mcu_skb_send_msg() for transmission and cleanup, leaving the skb permanently leaked. With EPSS at the 5th percentile, no KEV listing, and discovery solely via static analysis, this is a stability maintenance concern rather than an active security threat.
Control Flow Integrity (CFI) protection for the BPF subsystem's btf_dtor_kfunc_t type is silently compiled out in affected Linux kernel versions because BPF code references the deprecated CONFIG_CFI_CLANG symbol rather than the renamed CONFIG_CFI, leaving CFI violations in BPF destructor functions unchecked and capable of crashing the kernel. Locally-privileged users on affected kernel builds - those compiled with CFI support, typically Clang-built distributions - can trigger a kernel panic by interacting with the BPF subsystem. This vulnerability is not listed in the CISA KEV catalog, no public exploit has been identified, and the EPSS score of 0.16% (5th percentile) reflects minimal real-world exploitation probability.
Lock ordering deadlock in the Linux kernel BPF task_vma iterator allows a local low-privileged user with BPF program execution rights to trigger a system hang or denial of service. Holding the per-VMA lock across BPF program body execution creates a circular dependency (vm_lock → i_rwsem → mmap_lock → vm_lock) when BPF helpers internally acquire mmap_lock. Patches are available across multiple stable branches; EPSS is low at 0.16% and no public exploit or active exploitation has been identified.
RCU stall denial-of-service in the Linux kernel BPF subsystem allows a local low-privileged user to cause kernel-level availability degradation by triggering map clearing on a large PROG_ARRAY BPF map. The missing cond_resched() call in bpf_fd_array_map_clear() prevents CPU yielding during an expensive per-entry loop, starving the RCU grace period mechanism and triggering watchdog stalls in the deferred workqueue. No active exploitation is confirmed - EPSS is 0.16% (5th percentile) and the vulnerability is absent from CISA KEV - making this a maintenance-tier patch rather than an emergency response priority.
CPU stall vulnerability in the Linux kernel jitterentropy subsystem allows local low-privileged users to trigger prolonged non-preemptible spinlock holds by spawning concurrent entropy requests through jent_kcapi_random(), which holds a spinlock across expensive SHA3 conditioning and jitter collection. Systems running kernel versions from approximately 4.2 through pre-fix stable branches face entropy starvation and CPU busy-wait degradation under parallel getrandom() load. No public exploit identified at time of analysis; EPSS is 0.16% at the 5th percentile and no CISA KEV listing applies, making this a low-urgency, operator-pace patch for most deployments.
Availability disruption in the Linux kernel's AF_UNIX socket subsystem allows a local low-privileged user to trigger an unhandled code path by issuing a SIOCATMARK ioctl on non-stream (SOCK_DGRAM or SOCK_SEQPACKET) AF_UNIX sockets, which the kernel incorrectly permits to proceed into receive-queue inspection logic intended only for SOCK_STREAM. The flaw stems from a logic inconsistency: while SOCK_DGRAM and SOCK_SEQPACKET already reject MSG_OOB in sendmsg()/recvmsg(), the SIOCATMARK ioctl handler lacked the corresponding guard, creating an exploitable divergence. No public exploit or CISA KEV listing exists; EPSS at 0.16% (5th percentile) reflects a very low real-world exploitation probability.
Memory leak in the Linux kernel's amd-pstate driver allows local availability impact on systems running AMD CPUs when EPP (Energy Performance Preference) initialization fails. The amd_pstate_epp_cpu_init() function allocates a cpudata object at entry but lacks a corresponding free on the error path triggered when setting the EPP value fails, causing kernel heap memory to leak on each failed CPU initialization event. No public exploit exists and EPSS sits at 0.15% (5th percentile), reflecting negligible adversarial interest; risk is primarily operational - repeated CPU hotplug cycles on affected hardware can progressively exhaust kernel memory.
The Marvell Libertas USB WiFi driver in the Linux kernel invokes usb_kill_urb() and usb_kill_anchored_urbs() from interrupt context during the HCD giveback path, causing a kernel BUG() or deadlock because those functions may sleep. Systems with a Marvell Libertas USB WiFi adapter attached can be crashed by a local low-privileged user triggering the race condition, resulting in a denial of service via kernel panic. No public exploit exists and EPSS is 0.15% (5th percentile), indicating negligible exploitation probability; the constraint to specific legacy hardware further limits real-world impact.
Kernel availability impact in the Linux NTFS3 filesystem driver allows a local low-privileged user to trigger a WARN_ON(1) in attr_data_get_block_locked() by accessing NTFS volumes containing compressed or sparse attributes with frame-aligned cluster boundaries. The root cause is a missing run-segment load for vcn0 when it resides in a different attribute segment than vcn after cmask rounding, causing run_lookup_entry() to return SPARSE_LCN and fire the kernel warning. No public exploit has been identified and EPSS is 0.15% (5th percentile), confirming this as a low-probability exploitation target despite the confirmed vendor patch.
NULL pointer dereference in the Linux kernel ice driver's error path can cause a kernel panic on systems using Intel E800/E830 series Ethernet adapters. The flaw in ice_set_ringparam() leaves the ICE_TX_RING_FLAGS_TXTIME bit set after nullifying tstamp_ring, so a subsequent failure in ice_setup_tx_ring() triggers a dereference of a NULL tstamp_ring->desc pointer during error unwinding. No public exploit exists and EPSS sits at 0.15% (5th percentile), consistent with the discoverer's note that this was identified by manual code review rather than observed exploitation.
Unsafe NMI-context invocation of perf_allow_kernel() in the Linux kernel's AMD IBS (Instruction Based Sampling) perf handler can cause a fatal kernel crash on AMD-powered systems running affected stable branches from commit 50a53b60e141d7e3 onward. A local user with perf event access on an AMD system can trigger the IBS NMI handler path, inducing a kernel panic or deadlock as the unsupported function call violates NMI-context restrictions. No public exploit has been identified at time of analysis; EPSS is 0.15% (5th percentile), consistent with a niche hardware-specific kernel subsystem flaw with no current exploitation activity.
Kernel stack memory disclosure in the Linux TUN driver exposes 14 bytes of uninitialized stack data to unprivileged local users on every read of a non-tunnel packet. The flaw affects Linux systems where a local user can open a TUN device and issue the TUNSETVNETHDRSZ ioctl to set the vnet header size to 24 bytes. No public exploit or active exploitation has been identified; EPSS is 0.15% (5th percentile), consistent with a local-only information disclosure requiring deliberate TUN device configuration.
Stack information disclosure in the Linux kernel's tap/macvtap driver exposes 8 bytes of uninitialized kernel stack contents to local users via the SIOCGIFHWADDR ioctl, leaking kernel .text and direct-map pointers that defeat KASLR. The affected code path in tap_ioctl() copies a 16-byte sockaddr_storage to userspace while netif_get_mac_address() initializes only 8 bytes (sa_family plus 6-byte Ethernet address), leaving the trailing 8 bytes unread. No public exploit is identified at time of analysis and EPSS sits at 0.15% (5th percentile), but KASLR bypass primitives of this type are routinely chained with local privilege-escalation exploits to gain kernel code-execution. NOTE: The provided CVSS vector (C:N/I:N/A:H) appears to misclassify this vulnerability - confidentiality is the impacted property, not availability; the assessed vector below corrects this.
Memory leak in the Linux kernel block layer's zone revalidation path allows local low-privileged users to cause kernel memory exhaustion, resulting in a denial-of-service condition. Specifically, blk_revalidate_disk_zones() fails to free the args.zones_cond allocation on error paths after disk_revalidate_zone_resources() succeeds, leaving memory unreleased. No public exploit code exists and no active exploitation has been confirmed; EPSS probability stands at 0.14% (4th percentile), consistent with a low-priority local DoS affecting niche storage configurations.
Availability loss in the Linux kernel ublk (userspace block device) subsystem can permanently hang IO commands when a ublk recovery server dies before issuing fetch commands for all IOs in a queue. The per-IO canceled flag, once set, is only cleared when every IO in the queue is fetched - if the server crashes mid-recovery, surviving IOs with set canceled flags can never be completed because ublk_cancel_cmd is blocked from calling io_uring_cmd_done. This results in a denial-of-service condition affecting systems using ublk-based userspace block devices. No public exploit has been identified at time of analysis, and EPSS is 0.14% (4th percentile), consistent with a low-exploitation-probability kernel logic flaw requiring specific local conditions.
BPF local storage deletion in the Linux kernel deadlocks when `bpf_xxx_storage_delete()` helpers execute within a Non-Maskable Interrupt (NMI) context, because the underlying RCU-based freeing mechanisms (`kfree_rcu`, `call_rcu`, `call_rcu_tasks_trace`) are not safe in NMI or reentrant execution paths. Locally privileged users capable of loading BPF programs attached to NMI-triggerable events can exploit this to cause a CPU-level deadlock, denying availability on the affected processor. No public exploit has been identified and EPSS at 0.14% (4th percentile) confirms this is a very low probability of opportunistic exploitation; impact is purely availability.
Memory leak in the Linux kernel's network scheduler (net_sched) subsystem allows a local low-privileged user to exhaust kernel memory and degrade system availability. The flaw resides in qdisc_dequeue_drop(), which fails to account for root qdiscs that lack the TCQ_F_DEQUEUE_DROPS flag - leaving packet buffers stranded indefinitely on child qdisc to_free lists during qdisc_run_end() cleanup. No active exploitation is confirmed (not in CISA KEV) and EPSS sits at 0.14% (4th percentile), reflecting the low probability of opportunistic abuse given the local access and specific configuration requirements.
NULL pointer dereference in the Linux kernel's BPF socket storage subsystem (net/core/bpf_sk_storage.c) allows a local low-privileged user to crash the kernel. The race condition between bpf_selem_unlink_nofail() - which nulls smap before removing the element from the hlist - and concurrent RCU readers in bpf_sk_storage_clone() and bpf_sk_storage_diag_put_all() can be triggered during TCP SYN handling (socket cloning path), producing a kernel panic. No public exploit identified at time of analysis; EPSS of 0.14% (4th percentile) confirms negligible observed exploitation probability.
Jenkins Assembla Plugin 1.4 and earlier exposes a connection-test endpoint without adequate permission enforcement, allowing any Jenkins user holding only Overall/Read permission to trigger outbound HTTP connections to an arbitrary attacker-controlled URL with attacker-supplied credentials. This enables both a limited Server-Side Request Forgery (SSRF) vector for internal network probing and credential interception on the attacker's endpoint. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment confirms exploitation status as none.
Missing permission check in Jenkins EC2 Fleet Plugin versions up to 4.2.3.539.v8fedff2a_81c3 enables any authenticated user holding the low-privilege Overall/Read role to trigger a credential-capture attack by directing the plugin to connect to an attacker-controlled endpoint and transmitting AWS credentials stored in Jenkins. The attacker must independently obtain a valid credential ID before exploiting this flaw, making it a chained attack rather than a direct standalone exploit. No public exploit code has been identified at time of analysis and CISA has not added this to the KEV catalog; SSVC rates exploitation status as none.